Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Anonymous_User Absent Member.
Absent Member.

Retrospective Data enrichment


Is it possible to perform data enrichment retrospectively - may be after
few days? We have a external ticketing system and after the ticket is
resolved, I'd like the resolution code added to the respective
correlated rule.

If its too complicated, I rather not bother.

Please suggest.

pimpalp's Profile: https://forums.netiq.com/member.php?userid=5587
View this thread: https://forums.netiq.com/showthread.php?t=51938

1 Reply
Anonymous_User Absent Member.
Absent Member.

Re: Retrospective Data enrichment

The way to do this currently is with incidents within Sentinel. Have the
Correlated Event start an incident and then when your external ticketing
is completed have the incident updated with whatever data you feel should
be there.

Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.