Purpose: Customer tagging is a feature developed mainly to support Managed Security Services Provider (MSSP) environments, although it can also be used by private organizations to denote cost centers, internal groups, or subdivisions. The Customer designation keeps event traffic from multiple cost centers and/or business units clearly identified and separate. For more general information about this feature, see ESM 101.
The Customers resource tree, when populated, maps out the various external or internal customer accounts your enterprise tracks for cost, security analysis, or administrative reasons. These accounts, if present, are usually set up as part of the ArcSight deployment process. If the Customers resource tree is abbreviated or empty, your organization is probably not using this feature.
When the Customers resource tree is populated, you primarily use its branches as references in analysis filters that exclude or include certain customers.
Apart from analysis, the activities necessary to maintain the Customers resource tree include creating new customer references, editing existing references, and occasionally deleting references.
Where: Navigator > Resources > Customers
To create customers:
When you create a customer, remember that the branch you add to the resource tree has to match the Customer URI attribute configured for that branch in the relevant SmartConnectors. In other words, you create customer-tracking resources only for those customers that have parallel URI values set in the SmartConnectors that monitor their devices.
Right-click a customer group and choose New Customer.
In the Customer Editor, enter values for the properties that identify the customer. Note that the Name value has to complete the correct Customer URI for this account as found in its related SmartConnectors.
On the Networks tab, add the network for this customer, as required.
Click Apply to update the customer and leave the editor open, or OK to complete editing and close the editor.
To edit customers:
Right-click a customer and choose Edit Customer.
Change the values, as appropriate.
Click Apply to update the customer and leave the editor open, or OK to complete editing and close the editor.
To delete customers:
Right-click a customer and choose Delete Customer.
Click Yes to confirm the deletion.