Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class
709 views

Reporting on total event received daily, weekly, monthly

Hi all,

I try to make a report regarding:

- The number of event received daily, weekly, montly

- The number of case open

- The number of event mark as reviewed against the event received

...

But what is the better way to make this reporting?

DO you have a brief tutorial?

Thanks in advance

Tags (3)
0 Likes
7 Replies
Absent Member.
Absent Member.

Can you explain the objective of the report in detail?

0 Likes
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

As Arcsight is used by a SOC, we need to provide statistics on the total of events received by ESM, the total of event Reviewved (Ctrl+R), and also the stat of rules wich trigger an alert during the day. And also the number of case open and closed in ESM.

For exemple

Today in ESM we should have:

- 1 500 000 events receiveds from all collectors

- 250 000 has been mark as revieved and manually investigated (the Ctrl+R option in the cative channel)

- the rules have triggered

Login account ==> 14 000

Login during out of business ==> 1200

Sensitive files accessed ==> 3

...

- 3 cases have been opened

- name 1

- name 2

- name 3

- Some case have been closed

- name1

- name2

For the case stats I could make something, but for the total number of event and event reviewved I don't know.

0 Likes
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

No idea?

0 Likes
Absent Member.
Absent Member.

Try to creat a Pie-Chart dispaying how many have been reviewed and how many have not been reviewed.

0 Likes
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

YesI know that.

But I don't know what is the best method.

I know, that I need to select type base event and the count function.

But I think it took a very very long time to count the events for one day for exemple, as we receive more than million on event each day.

If I select one day period, ESM will query the database to retrieve all events reveived during the day.

Do you understand what I try to explain?

0 Likes
Absent Member.
Absent Member.

Did you get an answer to this?

0 Likes
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

Unfortunately I don't receive anyvaluable answer.

I had a case opened with the support.

But their anwers was: " Arcsight ESM is not able to make a such thing, it requires new feature"

I'm always searching a sokution for this.

I found a ways, using rules.

When a event come in ESM , it trigger a rule, the action of the rule will write a count in a file, using a script.

To detect and count a correlation rule, I made the same thing, each time a correlation trigger an alert, in the same time the rule will make a count in a file.

Same way for an annoted event

Regarding cases, I run a csv report

However this solution is ressource consumming.

Actually,I've another solution, which require to parse the server.log file.

This file contain a very big line, which is comma separated. You need to split the line using the comma, you have two value, the first can be moved in trash, the scond should be parsed wih the second token which is the pipe char. Then you can have the first wo information

Event received bu the connector

Event transmitted to ESM after filter out.

However this solution seems to miss some events. so the total count is not very precise (+- 20%)

I never received any great answer from the support... as all cases I've opened....

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.