Can be run on demand via UI, on a schedule, or over the Logger API. – Output formats include HTML, PDF, MS Excel, CSV, MS Word, Interactive HTML, XML .. Guide (PDF) 3 Understanding the User Interface 24 ArcSight Connector Appliance .. ArcSight Logger, ArcSight NCM, SmartConnector, ArcSight Threat. Contents 6 ESM Installation and Configuration Guide Confidential How do Configuration Guide Confidential /opt/arcsight A.

Author: Nikozahn Faebei
Country: Syria
Language: English (Spanish)
Genre: Business
Published (Last): 24 July 2006
Pages: 344
PDF File Size: 2.76 Mb
ePub File Size: 9.4 Mb
ISBN: 954-3-12211-865-8
Downloads: 31319
Price: Free* [*Free Regsitration Required]
Uploader: Nikor

The user interface allows you to add and remove fields as well as put them in the order that you want. Include raw data samples in search results.

Filters save the query expression, but do not save the time range or the field set information. The maximum number of rows you want to search. Saved search saves the query expression and the time range that you See the Filters and Saved Searches section below for lovger information.

Field Description Name The name of this configuration. This procedure can be used to activate the plugin and configure the integration.

How to Use Arcsight Logger

To manage the gulde, navigate to the Workflow Editor. Please note this field is based on the time that Arcsight received the log, not necessarily the time of the event itself.

You can also build more uuser queries once you know what you are looking for and in which field Arcsight is logging that information. All Peers The default is unchecked and searches only the local logger you are connected to.


Since there are dozens of fields that can be logged in Arcsight, using this feature will save you the time of scrolling through unnecessary data to find what you are looking for.

Management Center User’s Guide | ArcSight Marketplace

Be careful not to change existing filters this way that are not yours. When you save a field set, it will appear under the Shared Fieldsets category and will be huide to all other users of Arcsight.

When you run a search, the results show up at the bottom of the screen, most recent log on top. Please do not use this feature! The query will be entered into the search box for you; click Go after adjusting your time range as needed. The available security integrations appear as a series of cards. Earliest Result days The earliest results you want to see in number of days.

ArcSight Logger – Commonly Used Event Fields – ITKB – Confluence

Search Logs To search for logs in Arcsight, go to https: Enter a name for the search or filter. Max Rows The maximum number of rows you want to search.

Use these buttons to customize your field set. Choose whether to save it as a filter or a saved search, then hit save. To make the field set available for later use, hit Save. Uaer allows you to display only relevant fields for your results, removing fields that may not have meaning for what you are searching for.


Enter the string you are searching for here, or build a search query using the Arcsight column headers. The earliest results you want to see in number of days.

See the Search Queries section below. Once you log out of Arcsight, the field set will not be saved. Include raw data samples in search results Select this to include samples of raw data in your sightings search results. When you log in, you will be brought to the Analysis search page where you can search through all the logs you have access to in Arcsight to find the events you are looking for using basic search queries. The name of this configuration.

Load Saved Search or Filter: For example, if I want to show all Weblogin events for a certain person, I can find them by typing: If you click OK after customizing your field set, it will logver be available to you for your current session. To use a previously saved filter or search, click on the load saved search or filter icon.

Search Queries Search queries can be as simple logegr entering a login name, IP address, or other string you are interested in looking for. Select this to include samples of raw data in your sightings search results.