Arcsight rule

[gargSaab]

Hello Geek
Can anybody suggest me how to print values from an active list eg I populated an active list from a rule and this active list contains hostname .now I need to create second rule where I need to trigger an alert which contains all hostname values.
Any suggestions...

[kUMters]

Create a report which will give you a list of values from AL...

PS: To generate an alert (correlated event) you need input event to trigger it.

[manojs]

Make sure your AL has a Key Field.

Key field will be helpful when calling/comparing values in an AL using a Rule.

Use "InActiveList" condition in Rule to call AL where Hostnames are stored and make sure you map key field in the  AL.

This way you can write conditions to match AL values.

Hope this helps.

~Manoj S.