audit connector configuration changes
Does anyone know how to check which user applied a configuration change to a connector in the logging received by ArcSight?
I do know you can get that info from the 'Get Configuratin XML File'. However that makes it hard to write any content on.
The event 'Agent configuration change received' ( Device Event Class ID = agent:032 AND Device Event Category = /Agent/Configuration/Changed )
does not contain this info, nor does any event triggered by this event.
How would one show to mgmt when changes have been pushed and by whom, using standard usage of resources?
thanks a bunch.
el mejor ajo