How can I generate a weekly or monthly report on the total number of security events collected from all connectors in ArcSight ESM?
Cybersecurity
DevOps Cloud
IT Operations Cloud
How can I generate a weekly or monthly report on the total number of security events collected from all connectors in ArcSight ESM?
Hey there,
/All Reports/ArcSight Administration/ESM/Licensing/Licensing Report
Specify your desired time range (maybe first time try the default $Now-7d -> $Now
For the parameter LicenseType, enter EPS
This will show you EPS per day for the time range you specified.
You can convert this metric to total events per day pretty easily utilising the resources already available to you. Eg you could create your own variation of the report that shows as events per day using the same Query/Session List data, if indeed thats what you really need.
Cheers,
Ian.