Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
sjrb-jheidecker Absent Member.
Absent Member.
626 views

Resource Report

Is there any way to run a report/export a list of all of the resources in ArcSight? Without their attributes. I am just looking for Name/Created By/Type. Any Ideas? So far I've looked at the Resource Search tool, which doesn't seem to work no matter what I put in the search field, and the Archive tool, which pulls to much information. I guess I could query the database directly?
0 Likes
8 Replies
gportnoy1
New Member.

RE: Resource Report

Maybe you can try the archive tool. Export to xml and figure out a way to parse out what you need?
0 Likes
sjrb-jheidecker Absent Member.
Absent Member.

RE: Resource Report

Parsing, scripting, text manipulation and xml (especially xml) are words that scare me. <VENT>I just spent 8 hours staight writing a vb script that will export all of active directory and create an xml file that arcsight can read, only to find out that there is a 255 char string limit in vb and we have tons of array type ad fields that i cant convert to strings because they are too long!!</VENT> P.S. If anyone needs an example of a more recent vbscript for creating archive xml's let me know.
0 Likes
rgottumu Absent Member.
Absent Member.

RE: Resource Report

Hello: If you have access to the database as arcsight user then you can run the following query to get the report. It creates resource.lst file. sqlplus arcsight/password -Raju column name format a62 wrap column type format a15 wrap set pages 0 spool resource.lst select decode(resource_type, 0, 'Group', 1, 'User', 2, 'Filter', 3, 'Agent', 4, 'Device', 5, 'Rule', 6, 'KBase', 7, 'Case', 8, 'Note', 9, 'Report', 10, 'ArchivedReport', 11, 'ScheduledTask', 12, 'PatternDiscoveryConfig (Profile)', 13, 'UserSharedAccessibleGroup', 14, 'UserAccessibleGroup', 15, 'DatabaseTableSchema', 16, 'UnassignedResources', 17, 'File', 18, 'PatternDiscoveryRun (Snapshot)', 19, 'DataMonitor', 20, 'ViewConfig', 21, 'Portlet (Instrument)', 22, 'Dashboard', 23, 'Destination', 24, 'ActiveList', 25, 'VirtualRoot', 26, 'Vulnerability', 27, 'QueryGroup', 28, 'Pattern', 29, 'Zone', 30, 'Device Range', 31, 'Asset Category', 32, 'Partition', 33, 'DynaChannel', 34, 'Stage', 35, 'Customer', 36, 'NamedColumn', 37, 'NamedColumnList', 38, 'ScannedReport', 39, 'Location', 40, 'Network', 41, 'SavedReportParameterReport', 42, 'EscalationLevel', 43, 'ArcSightQuery', 44, 'ReportTemplate', 45, 'SessionList', 46, 'Trend', 47, 'Package', 48, 'ReservedTick', 49, 'ProjectTemplate', 50, 'AttachmentOnlyGroup', 'Unknown' ) "Type", name from arc_resource where deleted = 'N' order by 1 / spool off
0 Likes
sjrb-jheidecker Absent Member.
Absent Member.

RE: Resource Report

Raju, Thanks! Is there any way to get the created by and modified by user name? I see the Columns for CREATED and MODIFIED but nothing for the user? Could I join from another table?
0 Likes
rgottumu Absent Member.
Absent Member.

RE: Resource Report

I have added "Modified By" to the Query: column name format a62 wrap column type format a10 wrap set pages 0 spool resource.lst select decode(a.resource_type, 0, 'Group', 1, 'User', 2, 'Filter', 3, 'Agent', 4, 'Device', 5, 'Rule', 6, 'KBase', 7, 'Case', 8, 'Note', 9, 'Report', 10, 'ArchivedReport', 11, 'ScheduledTask', 12, 'PatternDiscoveryConfig (Profile)', 13, 'UserSharedAccessibleGroup', 14, 'UserAccessibleGroup', 15, 'DatabaseTableSchema', 16, 'UnassignedResources', 17, 'File', 18, 'PatternDiscoveryRun (Snapshot)', 19, 'DataMonitor', 20, 'ViewConfig', 21, 'Portlet (Instrument)', 22, 'Dashboard', 23, 'Destination', 24, 'ActiveList', 25, 'VirtualRoot', 26, 'Vulnerability', 27, 'QueryGroup', 28, 'Pattern', 29, 'Zone', 30, 'Device Range', 31, 'Asset Category', 32, 'Partition', 33, 'DynaChannel', 34, 'Stage', 35, 'Customer', 36, 'NamedColumn', 37, 'NamedColumnList', 38, 'ScannedReport', 39, 'Location', 40, 'Network', 41, 'SavedReportParameterReport', 42, 'EscalationLevel', 43, 'ArcSightQuery', 44, 'ReportTemplate', 45, 'SessionList', 46, 'Trend', 47, 'Package', 48, 'ReservedTick', 49, 'ProjectTemplate', 50, 'AttachmentOnlyGroup', 'Unknown' ) "Type", a.name "Resource", c.name "Modified By" from arc_resource a, arc_relationship b, arc_resource c where a.deleted = 'N' and a.id = b.sourceid and b.targetid = c.id and b.relationship_type = 12 order by 1 / spool off
0 Likes
sjrb-jheidecker Absent Member.
Absent Member.

RE: Resource Report

Thanks Raju!
0 Likes
plalo Absent Member.
Absent Member.

Re: RE: Resource Report

Any chance of getting an update of this query? Seems to not be working for me in 4.5sp2.

Thanks!

Brent

0 Likes
Highlighted
Rodion Super Contributor.
Super Contributor.

Re: RE: Resource Report

Another way to get Resource Report:

  1. Put all needed resourses into Package.
  2. Export package to .arb and unzip .arb file (it is zip archive)
  3. Download XMLStarlet freeware
  4. Read something about XPath query
  5. Run command like following in folder, containing unzipped arb:

xml sel -T -t -m "archive/Rule" -v "@name"  -o " | " -v "childOf/list/ref/@uri"  -o " || " -v "description" -n PackageName.xml

This query will give Name, URI and Description for all Rules in Package.

Good luck

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.