cancel
Showing results for 
Search instead for 
Did you mean: 

custom variables

Hi all ,

Can we create local variables , like in Arcsight (were in we can pull value using substring from a field) . if yes ... can any one help in how to create and use custom variables ?

Here my requirement is to capture events based on destination user name or ID    looking for service account.

use case : detect password changes to service accounts

(i guess service account will end with $   symbol)

regards

Raghu