Highlighted
salvatore.alba@ Super Contributor.
Super Contributor.
463 views

Custom Event Categorization tool missing in ESM?

Hi All,

In the ESM 7.0 Patch1 Console User's Guide there is a section on Event Categorization on page 940.

Apparently these should be a Categorisatin tool, but I cannot find it and have searched all documentation and looked on ESM 7 and ESM 5.5 to no avail.

The Console Guide states:

"From the ArcSight Console, you can manually apply categorization to one or more custom events from
a FlexConnector (or other custom or unsupported device). Once you apply categorization to events
from a particular device (and its associated connector), the categorization is automatically applied to
other events of the same type.
To apply event categorization to one or more events:
1. Select one or more of the same type of events that you want to categorize.
2. Select one or more events and choose the Categorize Event command from the System menu (or
click the toolbar button).
3. Select values from the given categories from the drop-down menus.
4. Click OK to apply the categorization information to events of this type.
This generates a SmartConnector update file (.aup) containing the new categorization files on the
Manager."

This is also mentioned in the ESM 101 guide on page 34: Event Categorization Utility.

Just wondering if I am missing a step, or the tool is indeed missing and the documentation was never updated.

Attached the screenshots from the guides.

Regards,

Salvatore

0 Likes
3 Replies
salvatore.alba@ Super Contributor.
Super Contributor.

Re: Custom Event Categorization tool missing in ESM?

Screenshot from Console Guide.

0 Likes
alexandrutatu Regular Contributor.
Regular Contributor.

Re: Custom Event Categorization tool missing in ESM?

Hi,

In Arcsight Console, up in the Menu bar you have: File Edit View Window etc..

Click on System, you will see Scheduled Jobs and Categorize Event.

0 Likes
salvatore.alba@ Super Contributor.
Super Contributor.

Re: Custom Event Categorization tool missing in ESM?

Hi @alexandrutatu

Thanks for your reply, I checked and cannot find it, I can see a scheduled jobs for creating a report for 'Daily missing categorisation'.

I was actually looking to find the feature as described in the Guide, which is missing. If you look at the guide and my screenshot there should also be a dedicated button in the Console.

I think they removed this feature andnever updated the Guides.

Thanks again,

Salvatore

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.