Configurations Attributes

Type

Choose the type of configuration from the drop-down menu:

• Script

• URL

• Connector

Note: The configuration type must match the command types in the configuration. (See Defining Commands for configuration instructions.) Once the configuration is saved, the type is not editable. This setting influences choices on other options for the configuration, such as the Type.

Name

A user-friendly, informative name for the configuration that (preferably, one that indicates the commands contained in it).

Allow Multi Select

Use this to allow selecting multiple events on which to run a command. It is off by default. A check mark indicates it is on/enabled.

When on, users can select multiple events and the commands assign the values to a parameter as a comma-separated list.

For example, suppose you have a command with the parameter ip=$targetAddress.

• With Multi Select disabled, the command accepts only a single IP address based on a selected event (for example, ip=192.0.2.0).

• With Multi Select enabled, a user can also get "ip=192.0.2.1,192.0.2.2" if two rows are selected.

In order for this to work: (1) the ArcSight Console context (for example, active channel) must allow multi-row selection, and (2) the integration target must support a comma-separated list of values for the given command and parameter.

Note: Multi Select does not affect how individual fields in an event are processed. Event field processing is determined entirely by the definition of command parameters. For example, a command with an Attacker Address parameter always gets that value from the selected event.