Highlighted
brett.pladna@hp Respected Contributor.
Respected Contributor.
504 views

Is there an ArcSight report that will show me all my users?

I need a report that will give me all the information or at least the first and last name of each arcsight user. Anyone know?

Labels (1)
Tags (3)
0 Likes
Reply
10 Replies
Absent Member.. Dean Farrington Absent Member..
Absent Member..

Re: Is there an ArcSight report that will show me all my users?

In 5.0 there are some login/logout reports, but I'm not aware of any that report on the configured users. We have been asking for that for a couple of years beacuse of the need to do account certification, but thus far our requests have gone unanswered. We finally had to build a script that  goes directly against the DB in order to extract the user information in order to meet our compliance requirements.

HTH

Dean

0 Likes
Reply
a2g Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

If you create an ESM Package with Users only, you can use the Resource Reporter utility to create a CSV or RTF document with user details.

Otherwise, you'd have to do a Custom Report or a direct database call.

A.

0 Likes
Reply
dha Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

If this is related to accounting, your best bet is ESM internal audit events (e.g. logon/off), but of course you wouldn't have detailed personal information.

For any user/individual-specific info, Actor is the official way to go on ESM. The whole Actor model was designed for correlating events with an actual person.

0 Likes
Reply
a2g Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

Duc,  I think Brett meant ArcSight ESM users.

A.

0 Likes
Reply
dha Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

I know. To be precise, a user on an ARST ESM is just an account on that ESM box. The Actor model would be able to show (info about) the actual PERSON behind that account, through an Actor resource.

Back to the original question, the cruel answer is NO

One work around is to manage an AL of users on your own. This is actually not too bad if the ESM user set is small and relatively stable.

0 Likes
Reply
a2g Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

The answer is 'YES' and it can be accomplished with reporting on the User resources directly.

0 Likes
Reply
agerra1 Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

My client is requesting me list of users having access to ESM with read/write access to resources. This is required for auditing, and I am not sure how to get these details.

There are some users who havent logged in to ESM, so login/logout details or reporting is useless. I need static report showing list of users, with groups they are under and rights assigned.

0 Likes
Reply
a2g Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

The only way to pull this information is with a Custom Report which will query the users table.

A.

0 Likes
Reply
agerra1 Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

Has the required information that I need.

Under <ArcSightManagerHome>/bin - Execute following:

1. arcsight ACLReportGen -m grouplevel

2. arcsight ACLReportGen -m userlevel

This gives me required information about users/groups/access control policy.

Arun

0 Likes
Reply
a2g Absent Member.
Absent Member.

Re: Is there an ArcSight report that will show me all my users?

Looks like that works also. Unfortunately, ArcSight never publicized this tool.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.