How to setting generating detailed baseEventdata
I generated XML containing only baseEventIds
Use the settings in the article
To preserve base events in exported cases add "perserve.baseevents=true" to the server.property file
add "perserve.baseevents=true" to ESM server.properties ,use manager-reload-config but failure
Used to restart, rather than reload?
thank you all
I have read it.
There are ways to output Correlation event include Base event details detailed,Not Only BaseEventIDs?
I don't understand it step,There is no difference between the native file and the sample file.
Change the /opt/arcsight/manager/config/archive/xml.external.case.xml file to uncomment the relevant section.
Need to add parameters？
Thank you for your help