ArcSight Ideas - TEMPORARILY CLOSED
cancel

Internal audit event for Annotations

Include an internal audit event that tracks annotation stage changes to capture metrics

2 Comments
Frequent Contributor..

any work arounds?

Absent Member.

My workaround:

1. Create trend(s) to track all events with an annotation or specific stage. Offset data collection enough to capture the annotated events (or use multiple trends and refresh data intervals)
2. Have the trend(s) add data to an active list (under the Actions tab)

3. Query the Active List Entry Added events or create a rule to trigger on each of these events (to parse dc4)

4. Now you have audit events for annotations and stages!