Showing results for 
Search instead for 
Did you mean: 

custom variables

Hi all ,

Can we create local variables , like in Arcsight (were in we can pull value using substring from a field) . if yes ... can any one help in how to create and use custom variables ?

Here my requirement is to capture events based on destination user name or ID    looking for service account.

use case : detect password changes to service accounts

(i guess service account will end with $   symbol)



More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator