How to prevent your SIEM from being blind Getting logs from multiple systems also requires correct permissions, network settings, proper resources, and perfect KeepAlive alerts. But what happens if something goes wrong? Apparently, the logs will not arrive. We will focus on a problem that can cause peripheral blindness with minimal effort: Disable SIEM service […]
When you want to add external information to Active Lists in ArcSight as a solution, you have to build a custom flex connector, parse the data, and create a pre-persistent rule that will add the information to the Active List.
The CyberSIEM team has developed a tool that makes taking care of these exclusions as simple as creating an Active List.
We, CyberSIEM, developed a tool that will delete the cases with the ArcSight API the right way, without hurting the job.
How to create a data monitor which will collect the information from the last X time, and sum the quantity and create a rule that use the audit events of the Data Monitor to check if the value is more than a specific threshold.
Have you ever wanted to create a rule that has the ‘Contain From Active List’ condition in ArcSight?