Arcsight - Get events related to the Case

Get the Case's Arcsight ResourceID from the FetchID field, or the "ID" label. If neither is there, ask user for the ID. Use the resource ID to get full data for the case, the correlated/aggregate events underneath it, and all base events underneath them.

ArcSight ESM · 14 tasks · 0 inputs · 0 outputs

Commands used

as-get-all-cases as-get-case-event-ids as-get-security-events setIncident

Flowchart

yes yes yes yes Start Start Arcsight - Get Case info - as-get-all-cases Arcsight - Get Case info as-get-all-cases Arcsight - get Event ID below the Case - as-get-case-event-ids Arcsight - get Event ID b... as-get-case-event-ids Get the Events below the Case - as-get-security-events Get the Events below the ... as-get-security-events Is FetchID set? - Exists Is FetchID set? Exists Is ID label included? - Exists Is ID label included? Exists User - please insert Arcsight Case Resource ID - Set User - please insert Arcs... Set Get case and event info Get case and event info Get Base Events below the top-level event - as-get-security-events Get Base Events below the... as-get-security-events Does Case included IDs for related Events? - Exists Does Case included IDs fo... Exists Done Done Do we have IDs for underlying base events? - Exists Do we have IDs for underl... Exists Set FetchID from user input - setIncident Set FetchID from user input setIncident Set FetchID <-- ID label - setIncident Set FetchID <-- ID label setIncident