Not absolutely that.
At me version ArcSight ESM 5.0.
And for my version there is such document (ESM System Content Reference Guide), this document describes compilations of rules of correlation.
That you have sent that to me to THANKS)). But it would be desirable for the version ESM 5.0
PS: I Apologize for the incorrect text. I badly know English language, I and Russia.
I think you need to pay for "Professional Services" to get help out with that. Or learn it on your own.