Wrapping your arms around Trends: Part 3 (with a side dish of custom parameters)

What a week. Found a couple issues with our 5.0 install with varying degrees of critically. One is being fast tracked so will see what we see. While I'm confident they will be addressed, I'm also the type of guy who would just assume they are fixed yesterday. However, I also waited tables in what seems like a past life. I try to be very conscious about blaming the waiter for a burned steak. There is also a bit of thoughtful reflection as I sit here in Chick-fil-A listening to the music and chill'n while the family assault vehicle is getting an oil change across the street. It isn't the music that is causing the reflection (though it certainly can and hopefully will have that effect) as much as I wonder at the possible connection, if any, between this post and these (1 & 2) that talk about ArcSight tentatively looking for a buyer. Only time will tell what the long term effect acquisition will mean.

At any rate, as a short continuation of this "series" here is a quick report taking the concept of the first article with the Trend created from the second. Since you are pulling from this new Trend you can see all the data in one report - when it started, ended, how long it took, insert count, and ultimately if it was successful or not. Unless you enjoy mentally converting milliseconds into minutes I would recommend creating 2 variables that will convert the time to minutes. The first is to divide the milliseconds by 60,000. The next uses the round variable to convert the first variable to the closest whole minute. Is it exact? No, but unless you have a Trend that is bumping up against the hard coded time limitations for Trend query runs does it really matter?

Wrapping your arms around ArcSight Trends - Part 2

I ended part 1 of this Trend mini series by giving a quick and dirty way to see when your Trends start. While the report does have value it doesn’t show things like how long the Trend ran, how many insertions there were, or whether or not it was ultimately successful. A report that had all that data would be ideal. The problem, as such, is ArcSight doesn’t show when the Trend actually started in the event generated when the run ends. DeviceCustomDate1 shows the start of that run’s interval though if that is of value to you.

There is a common event key found in all three events (start x1, end x2 based on success or failure) which is found in deviceCustomString5. This appears to be a combination of epoch time + perhaps the number of actions performed by the ESM that day. So now you just need a rule to add the endTime + dCS5 to an active list and reference that list in a rule that looks for a Trend run completion event. Only…..you can’t pull the creation date field from an Active List in an AL lookup variable….and you can’t aggregate on the endTime field in order to add that to a field in an Active List (through 4.5 – dunno about 5.0 yet).

Wrapping your arms around ArcSight Trends - Part 1

Anyone else’s drive into work getting a little darker? I feel like the summer has FLOWN by. Before too long it will almost be back to a military 0’dark 30 to 0’dark 30 - at least relative to the sun; I'm not working additional hours :)

There are a number of things rattling around in my head I’d like to write about and even some things I indicated I would write about in previous posts. Work, family, summer, and the cumulative lost sleep effects from fighting through some weird sinus issue for the last 6 months have conspired to work against this goal. 60 back pokes and 22 shots in the arm have at least indicated it not being allergies. Good times.

For S&Gs I think this will be the start of a short series of posts/articles/whatever on Trends. My next post may or may not be the continuation lol. If it isn’t I WILL come back to it.

A little ArcSight conference breakout session self promotion

I figure since I have a blog upon which to write why not do a little promotion for the breakout session I am leading at the ArcSight 2010 User Conference.

I knew going into the 2009 User Conference that based on our daily event count ArcSight thought of us as being a medium sized company – and on the lower end at that. Certainly, I thought, we weren’t really “that” small. In short, we were. The reality is even though our event count has increased since then, we still are. At last year’s conference I was quickly struck by the number of very large companies who use this product and their multiple hundred million EPD. By and large the historic ArcSight tool and mindset has been with this sort of company in mind. One can generalize they have a 24x7 SOC with staff ready to receive alerts and respond in (near) real time. (accurate?) As a relatively small shop (average or mean sized?) we simply don’t have the same level of staffing resources. This has led us to a somewhat non-traditional alerting system.

ArcSight 2010 User Conference breakout session list has been posted

The ArcSight 2010 User Conference breakout session list is out for those that haven't seen it yet (Conference information can be found here). I really enjoyed last year's conference and am certainly looking forward to this one. If you are on the fence about going and haven't gone to one yet - send someone. Actually send 2 someones; a manager and an ArcSight admin type. This way, in theory, you can absorb and later plan at the strategic and tactical level. If you send 2 people see if your company can spring for travel for a 3rd person by tapping into ArcSight's "BOGO" deal - send 2, get the third ticket free. If you are going to be deploying or have just deployed you REALLY need to send someone(s). I mentioned to my boss last year that if we had gone it would have escalated our development/grasp of the tool by at least 3 or 4 months since the conference happened between when we made the decision to go with ArcSight and when professional services came out to install it. Granted that curve gets smaller the longer you have had the product in house and how much time/FTE you have dedicated to the tool.