How to investigate on case events ?
I'm new to ArcSight and I wonder how to investigate on case events (correlation events and correlated events) ?
How can I directly have these events in a search (or a channel) from my case ?
From this search (or channel) I want to investigate using filters, making charts (timeline, group by...) ...
I have tried with Console and Comand Center but I did not find this feature.
From the case ressource I can only see case events details but I did not manage to investigate.
Any idea ?
Re: How to investigate on case events ?
I have finally found how to do this from the Console: right-click on a case in the left panel, "Case Details Channel".
It creates a channel with correlation and correlated events.
In fact it uses the filter "Event ID InCase /URI/OF/THE/CASE".
Is there any similar feature in the Command Center ?