ArcSight Discussions
cancel

Use of Active List for matching IDs

SOLVED
Go to solution
rgrace1 Contributor.
Contributor.

Use of Active List for matching IDs

Hi All,

I currently have a fitler set up for events that match a set list of IDs (custom application). I can see that you can create a filter to check an Active List, and I know how to add these IDs to the list, however my query is will this list remove the entries due to the TTL settings? I want to make it easier for my backup employees to add IDs to this list but don't want to lose any entires (unless manually removed)

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
 Super Contributor... brian.chong@hpe  Super Contributor...
 Super Contributor...
Solution

Re: Use of Active List for matching IDs

Hi,

So there is a TTL paramter in Active List which you can modify. By default, it's set to 1 day meaning any entry added will be expired after 1 day. You can set TTL of the Active List to 0 which means all entires will never expiire unless you manually remove it or via a Rule.

So if your Active List has TTL of 1 day, then yes it will expire 1 day after an entry has been added.

thanks,
Brian Chong

2 REPLIES
Highlighted
 Super Contributor... brian.chong@hpe  Super Contributor...
 Super Contributor...
Solution

Re: Use of Active List for matching IDs

Hi,

So there is a TTL paramter in Active List which you can modify. By default, it's set to 1 day meaning any entry added will be expired after 1 day. You can set TTL of the Active List to 0 which means all entires will never expiire unless you manually remove it or via a Rule.

So if your Active List has TTL of 1 day, then yes it will expire 1 day after an entry has been added.

thanks,
Brian Chong

rgrace1 Contributor.
Contributor.

Re: Use of Active List for matching IDs

Hi Brian,

Thank you for the confirmation, that is what I ended up setting setting up but needed that extra assurance of what I had done was correct.

Thanks

Ray

Key Links
 

GDPR goes into effect on 25 May 2018!

We have created a 9-webinar series, (1 overview webinar and 8 use-cases) aligned to the ‘five critical technology capabilities for GDPR compliance scenarios’ as set out by PwC. Find more details and links here!

  Accidental non-compliance could be costly!

Top Contributors Last 30 Days