Hi all ,
Can we create local variables , like in Arcsight (were in we can pull value using substring from a field) . if yes ... can any one help in how to create and use custom variables ?
Here my requirement is to capture events based on destination user name or ID looking for service account.
use case : detect password changes to service accounts
(i guess service account will end with $ symbol)