0 Replies Latest reply on May 13, 2015 2:58 AM by rboppidi

    custom variables


      Hi all ,


      Can we create local variables , like in Arcsight (were in we can pull value using substring from a field) . if yes ... can any one help in how to create and use custom variables ?


      Here my requirement is to capture events based on destination user name or ID    looking for service account.


      use case : detect password changes to service accounts


      (i guess service account will end with $   symbol)