ArcSight ESM 101 training - part 1 - lifecycle of events

This is part one of what is called the ESM 101 series. This is a 6 part session that covers the basics of an event, the lifecycle of an event and a bit more detail around dashboards, data monitors, rules and so on. The idea behind these sessions is to help newcomers and beginners with what ArcSight ESM is, does, processes and can do. More to come on these sessions, but this is a good start.


The sessions are broken down as follows:

Part 1 - Event schema and event lifecycle
Part 2 - Command Center basics (event searching)
Part 3 - Filters, active channels and field sets
Part 4 - Dashboards and data monitors
Part 5 - Lists and Rules
Part 6 - Trends, reports and queries

Credit goes to Tammy Torbert for the content and materials and for the assistance in creating this session.