Maintenance is complete- We've moved from the domain to click to read more
As part of our journey to complete our separation work and our future integration with Micro Focus, we've now updated our domain for the community. This is an interim step, which will be followed by a series of future update / improvements: - Piloting Idea boards - Refreshing the entire UI. (more to come later) - and more
ArcSight Discussions

ESM Content Authoring Best Practices

Honored Contributor.

ESM Content Authoring Best Practices

Attached is the latest version of the ESM Content Authoring Best Practices guide.

This is a living document, and there is much to add. Please feel free to post questions and comments below.

Topics to address (as of 2017-10-23):

  • Asset Categories
  • The priority fields in setting event fields in rule actions
  • Package obfuscation|Users and removing users, especially with respect to content issues and package imports
  • Derived fields, especially the requestURL fields, especially checking for requestUrlHostName IS NOT NULL, and user requestUrl IS NOT NULL, insteadAggregation on Name
  • About COUNT(eventID) and SUM(aggregatedEventCount)
  • Managing content sync packages

Things to explore:

  • Test enforced filters on rules (it works on DMs)
  • Test permissions for assigning events to other users in other groups (e.g., /All Users/Default User Groups/Operators and /All Users/Default User Groups/Operators/Analyst)

 See also: