Hi,

I installed the L2-Network Monitoring - Situational Awareness package and noticed a broken resource.  The rule "Web Proxy Identified Exploit Traffic" is dependent on an Active List that does not exist.

Rule /All Rules/Real-time Rules/ArcSight Activate/Solutions/Network Monitoring/Situational Awareness/Web Proxy Identified Exploit Traffic depends on resource /All Active Lists/ArcSight Activate/Solutions/Perimeter and Network Monitoring/Situational Awareness/Proxy Identified Exploit Kit Queries that cannot be found.

On a side note, from the L2-Perimeter Monitoring - Situational Awareness package I noticed 2 broken resources.  The rule "Egress Communications to Suspicious Region" and "Ingress Communications from Suspicious Region".

Rule /All Rules/Real-time Rules/ArcSight Activate/Solutions/Perimeter Monitoring/Situational Awareness/Egress Communications to Suspicious Region depends on resource /All Active Lists/ArcSight Activate/Solutions/Perimeter and Network Monitoring/Situational Awareness/Suspicious Region - ITAR_OFAC Countries that cannot be found

and

Rule /All Rules/Real-time Rules/ArcSight Activate/Solutions/Perimeter Monitoring/Situational Awareness/Ingress Communications from Suspicious Region depends on resource /All Active Lists/ArcSight Activate/Solutions/Perimeter and Network Monitoring/Situational Awareness/Suspicious Region - ITAR_OFAC Countries that cannot be found

I used the latest packages available from the HP Marketplace and installed them in the order below.  Older versions of the packages which require migration were never installed.

ArcSight Activate Base 2.4.0.0

L1-Perimeter Monitoring - Indicators and Warnings

L2-Perimeter Monitoring - Situational Awareness

L1-Network Monitoring - Indicators and Warnings

L2-Network Monitoring - Situational Awareness

Has anyone else experience this?  What's the best way to resolve this issue with the broken resources?

​

Check this link: .  There is a resolution to the broken resource.  The active list is in a different location.  However, I just did a search in ESM for Proxy Identified Exploit Kit Queries, but could not find it. Leave it to HP to put out a product that is not ready or useful.......I really hope they put out some use cases and direction for the L2 packages.

​ isnt this problem fixed in the package mentioned above? I see that it was posted after the package was published on marketplace.

Thanks :-)

Same here, I could not find Proxy Identified Exploit Kit Queries

Hey,

Apologies for the delayed response. I just installed the L1-Network Monitoring and L2-Network Monitoring packages, as well as the L1-Perimeter Monitoring and L2-Perimeter Monitoring packages. For /All Rules/Real-time Rules/ArcSight Activate/Solutions/Network Monitoring/Situational Awareness/Web Proxy Identified Exploit Traffic, the conditions should look like this:

 I know this sounds lame, but I cannot reproduce the problem you've stated. The list is at /All Active Lists/ArcSight Activate/Solutions/Network Monitoring/Situational Awareness/Proxy Identified Exploit Kit Queries.

Hope this helps,

--

Prentice

Hi Prentice

I just did a clean install of the L2-Network_Monitoring_-_Situational_Awareness_0.1.0.0 package, this was not an upgrde. I got the same problem where theres a reference to the Proxy Identified Exploit Kit Queries Active List under /Perimeter and Network Monitoring/Situational Awareness which dosnt exist in my enviroment.

It doesnt look like the Active List is included in the package also..

Cheers

Mark

Same issue here as , no Active List or Filter.

Also, don't know if this is related but I noticed two issues with the install. With the second screenshot, I don't see that Package in the Console. Unfortunately, no time to research right now.