The rule for adding events to the active list in real time stops working after the first run

Question

Hi 
 I have a connector that sends events in CEF format to ArcSight. 
 I created an active list and described a rule that listens for events with the fields Device Vendor = AlienVault and Device Product = OTX and adds them to the active list. Everything works correctly, but after some time after adding the first events to the list, the image of the rule changes its appearance and stops working. 
 I will briefly describe my implementation steps: 
 Rule type - standard 
 Condition - event1 : ( DeviceVendor = AlienVault AND Device Product = OTX ) 
 At each event, add to the active channel 
 aggregation: 
 of matches 1, time frame 2 minutes 
 Aggregation only if these fields are identical event1.Device External ID event1.Name event1.Device Event Class ID event1.Device Custom Date1 event1.Destination Address event1.Device Custom Number1 event1.Device Custom String4 event1.Device Custom String3 event1.Device Custom Date2 event1.Device Product event1.DeviceVendor 
 After receiving the first events in the active list, after 2-3 minutes, the rule itself changes its appearance and stops working

What is the problem and how to solve it? 
 Thank you in advance 
 Bohdan

Ionut Daniel Mosoiu · Accepted Answer

Hello Bohdan, 
 
 open your ESM console select Dashboards from Resources and navigate to "Rules Status" by selecting Dashboards -> Shared -> All Dashboards ->ArcSight Administration -> ESM -> System Health -> Resources -> Rules. 
 Select Rules Status by double click on it ( or right-clicking -> choose "Show Dashboard" ) and search for the audit event related to that specific rule on the bottom inside of the Dashboard in the section "Rule audit events ". 
 You may find this helpful Dashboard including others to monitor the health of your environment. 
 There can be many reasons why the rule is disabled. Please have a look over this link https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.7/ESM_ArcSightConsole_UserGuide_24.1/#ESM_UserGuide/Automatically_Disabled_Rul.htm?Highlight=Rules%20Status why the rule is automatically disabled and the cause of it. 
 Have a look over this https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.7/ESM_ArcSightConsole_UserGuide_24.1/#ESM_UserGuide/Rules_Engine_Statistics.htm?Highlight=Rules%20Status to understand how to monitor the "Rules Engine Statistics". 
 
 The last thing for you to understand the rule behavior please have a look over the Audir Events related to Rules on different situations: 
 
 Rule Actions - https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.7/ESM_ArcSightConsole_UserGuide_24.1/#ESM_UserGuide/AuditEvents_RuleActions.htm?TocPath=Reference%2520Guide%257CAudit%2520Events%257C_____35 
 
 Rule Activations - https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.7/ESM_ArcSightConsole_UserGuide_24.1/#ESM_UserGuide/AuditEvents_RuleActivat.htm?TocPath=Reference%2520Guide%257CAudit%2520Events%257C_____36 
 
 Rule Firings - https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.7/ESM_ArcSightConsole_UserGuide_24.1/#ESM_UserGuide/AuditEvents_RuleFirings.htm?TocPath=Reference%2520Guide%257CAudit%2520Events%257C_____37 
 
 Rule Wornings - https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.7/ESM_ArcSightConsole_UserGuide_24.1/#ESM_UserGuide/AuditEvents_RuleWarning.htm?TocPath=Reference%2520Guide%257CAudit%2520Events%257C_____38 
 
 Rule Scheduled - https://www.microfocus.com/documentation/arcsight/arcsight-esm-7.7/ESM_ArcSightConsole_UserGuide_24.1/#ESM_UserGuide/AuditEvents_RuleSchedul.htm?TocPath=Reference%2520Guide%257CAudit%2520Events%257C_____39 
 
 I hope that having this information you will be able to understand what's wrong with your Rule and how to design not to be automatically disabled.

Best Regards, 
 
 Daniel

Menu

ArcSight Discussions

The rule for adding events to the active list in real time stops working after the first run

Tags:

Top Replies

Verified Answer

Resources