Collaborating on Events (Event Annotation)

You can use workflow-style annotation to collaborate with other users in analyzing or reviewing selected events.

When you are annotating, you can make collaboration-stage changes to just the event you originally selected, or have that change also affect a larger set of similar events that should also be carried forward in the review process.

The central tasks in annotating events for collaborative analysis are assigning them to yourself or another user, then assigning them to one of the available sequential workflow stages (dispositions). While ArcSight comes with a default set of stages, your enterprise will very likely have customized these stages and created new ones.

Compare collaborative annotation to cases, which are a more formal way to track sets of events that are under investigation.