Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Trusted Contributor.. joearcsight Trusted Contributor..
Trusted Contributor..
412 views

ArcSight ESM search commands

Hi everyone,

I am new to the ArcSight world. I am a IT Security Manager at a firm and my role is a ICT Security Specialist and I'm a novice at that and my role. I don't have much IT knowledge but learning rapidly. I was hired on the terms that I would be taught my role and develop over time.
No one at the firm knows how to use the ESM or the browser Command Center and it's up to me to work it out.
We are running the lastest updated 7.0 Connecter.
What I am wanting to know is some commands to run logs and events such as looking up peoples names for what they have accessed or failed/successful logins, or anything that they have tried to perform illegally within the firms system. These logs will be required to be presented to my supervisors for analysis.
Can someone help me with some commands to use or guide me where to look for these commands.
Thank you. 

7 Replies
vatsal1888
New Member.

Re: ArcSight ESM search commands

Hi Joe,

Its very easy work on ESM, if you want to search for people who are doing abnormal or malicious activities inside the organisation.

First of all you need to open Active Channel, create a filter in the right hand side with below conditions.

sourceuser not null

categorybehavior = authentication

or

categorybehavior = access

or

categorybehavior = Modify

___________________________

Note: In Active Channel, arrange the fields accordingly

 

Trusted Contributor.. joearcsight Trusted Contributor..
Trusted Contributor..

Re: ArcSight ESM search commands

Thank you vatsal1888 for your information. I will give this ago. Much appreciated.

0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: ArcSight ESM search commands

Hi 

Welcome to the group.
A great place to start would be to run through some of the activities in the "ArcSight ESM in 4 Hours" document - it is a bit old now, but is still relevant and gives you some guided hands on.

https://community.microfocus.com/t5/ArcSight-User-Discussions/ArcSight-ESM-in-4-Hours/td-p/1588067

there are some great training videos from an ArcSight alumni - Paul Brettle:

https://www.youtube.com/playlist?list=PL6IBs2OOn8totlfJRqkE18KxA3NJALDf8

Once you have run through that, you will have a good feel for how to do the basics - and then start to discuss with your team what you want to get out of the tool and where to go next - if you need any help / guidance then just ask.

Kev

 

EDIT: updated link for future reference - Thanks @kzamuda 

Trusted Contributor.. joearcsight Trusted Contributor..
Trusted Contributor..

Re: ArcSight ESM search commands

Thank you kevquinlan. I will also check these out. Much appreciated.

0 Likes
Trusted Contributor.. joearcsight Trusted Contributor..
Trusted Contributor..

Re: ArcSight ESM search commands

Hi kevquinlan, I have tried the first link but does not seem to work. The second link I will have to try at home as our network at work restricts us from YouTube. I will try both of your links at home. Cheers for your assistance.

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: ArcSight ESM search commands

Hi,

It seems there was a typo when @kevquinlan  was pasting the link. Try this one, it should work fine:
https://community.microfocus.com/t5/ArcSight-User-Discussions/ArcSight-ESM-in-4-Hours/td-p/1588067

Regards,
Kresimir

Trusted Contributor.. joearcsight Trusted Contributor..
Trusted Contributor..

Re: ArcSight ESM search commands

Thank you kzamuda. That link worked. Much appreciated. Cheers.

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.