QuestionQ28Verified/AnalyticsCopy linkReport a problemAsk AstroTutorSave questionRefer to the following exhibits. What information will this analytics search display?AFailed machine login events with a source IP address of servers in the Device IP reportBAll servers in the Logon Failure user groupCFailed login events from all servers in the Server Inventory configuration management database (CMDB) reportDFailed login events from all servers defined in the CMDBShow AnswerAnswerExplanationThe criteria restrict events to the last 10 days where the destination IP matches a Device IP returned by the Server Inventory report and the event type belongs to the Logon Failure group. The combined conditions therefore return failed login events from servers listed by that report. ArcSight searches use specified fields and operators as filter criteria. Understand the Types of Search QueriesLearn moreUnderstand the Types of Search QueriesShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion