HDTutorial
EN
How to create a Joined Standard Rule in ArcSight ESM

Playback starts YouTube’s embedded player (privacy-enhanced mode).

How to create a Joined Standard Rule in ArcSight ESM

3,095 views September 29, 2020 14:08

Watch on YouTube
ChannelTsvetelin Kutsarov

Description from the creator

If you have found what I do interesting and if you would like me to continue you can check the link below 😊

buymeacoffee.com/nextgensiemtalks

In this video you'll see a demonstration on how to create a joined standard rule in ArcSight ESM.
In the example I'm correlating events generated by two different data sources
1. Badge Card Reader
2. Microsoft Windows Login events.

The result is a created correlation event which notifies SOC analysts and operators that an individual has gained not just a physical entry but as well logged in successfully.

Hope you like the video!

About this tutorial

Tsvetelin Kutsarov published this 14:08 video tutorial on September 29, 2020. It has been watched 3,095 times on YouTube.

Duration
14:08
Published
September 29, 2020
Views
3,095
Likes
40

Tags

Share

This tutorial in other languages