• State Not Answered
  • Replies reply
    1
  • Subscribers subscribers
    24
  • Views views
    125
  • Users 0 members are here

Comparison of a specific random event field with the active list

Bohdan Hotsuliak

Hi

Maybe someone had to face a similar problem. I need help describing a rule that will compare a specific event field with a specific column in the active list.

The first question: is it possible to implement?

I've looked at ArcSight's built-in rules that interact with active lists in some way, but I still don't understand how it works.

I've read that this may require defining local variables for the rule, or is it possible to do without them?

Can someone explain this with an example?

I just need to take a certain field from the incoming events and compare it to a column in the active list.

Mostly it is an IP address


Thank you in advance!

Bohdan

  • 0  

    Hey Bohdan, list lookups require you to specify all the key fields you want to lookup (for Lists with keys). You can edit the list and have a look at the list definition to find out which ones are the keys.
    For lists without keys you need to specify all fields to determine if the record is in the list or not.
    If it is a Event Based List, you would need the event to have the fields populated in the same fields as written to the list.
    If it is a Field Based List, there is a bit more flexibility and you need to specify which event field to use to lookup each field in the list.

    Have a go, it makes sense once you try it out.

    Cheers!

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.