NOTICE: Branded Content
NOTICE: Certain versions of content (“Material”) accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.
ArcSight User Discussions
cancel

Use of Active List for matching IDs

SOLVED
Go to solution
rgrace1 Frequent Contributor.
Frequent Contributor.

Use of Active List for matching IDs

Hi All,

I currently have a fitler set up for events that match a set list of IDs (custom application). I can see that you can create a filter to check an Active List, and I know how to add these IDs to the list, however my query is will this list remove the entries due to the TTL settings? I want to make it easier for my backup employees to add IDs to this list but don't want to lose any entires (unless manually removed)

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
 Honored Contributor... brian.chong@hpe  Honored Contributor...
 Honored Contributor...
Solution

Re: Use of Active List for matching IDs

Hi,

So there is a TTL paramter in Active List which you can modify. By default, it's set to 1 day meaning any entry added will be expired after 1 day. You can set TTL of the Active List to 0 which means all entires will never expiire unless you manually remove it or via a Rule.

So if your Active List has TTL of 1 day, then yes it will expire 1 day after an entry has been added.

thanks,
Brian Chong

2 REPLIES
Highlighted
 Honored Contributor... brian.chong@hpe  Honored Contributor...
 Honored Contributor...
Solution

Re: Use of Active List for matching IDs

Hi,

So there is a TTL paramter in Active List which you can modify. By default, it's set to 1 day meaning any entry added will be expired after 1 day. You can set TTL of the Active List to 0 which means all entires will never expiire unless you manually remove it or via a Rule.

So if your Active List has TTL of 1 day, then yes it will expire 1 day after an entry has been added.

thanks,
Brian Chong

rgrace1 Frequent Contributor.
Frequent Contributor.

Re: Use of Active List for matching IDs

Hi Brian,

Thank you for the confirmation, that is what I ended up setting setting up but needed that extra assurance of what I had done was correct.

Thanks

Ray

Key Links

Micro Focus is looking for research study participants to help us improve our website. Tell us what you think, and in exchange for your time we'll send you a small thank-you, like a gift card. Sign up or learn more 

Top Contributors Last 30 Days