Managing Notification Destinations

Destinations are mapped to user groups, therefore, make sure the user group exists (Managing User Groups) for the destination you are creating.

To create or edit destinations:

  1. In the Notification resource tree in the Navigator panel, right-click an escalation level (such as Level 1).

  2. If you are creating a destination, choose Add New Destination.

    If you are editing a destination, right-click a notification destination and choose Edit Destination.

    For more information, see Changing Notification and Acknowledgment Settings.

  3. In the Notification Editor, enter a label for the notification in the Name field.

  4. Optionally set a Start Time and End Time during the day within which the notification is to be active. The default is all day (12:00:00 AM to 11:59:59 PM).

  5. Select a Destination Type and the related parameters for that type, as follows:

    • For Console, additionally select a user or a user group. This displays the notification on the users’ ArcSight Console when they log in.

    • For Email Address, enter a valid email address and additionally select a user or user group.

    • Note: Always set the ArcSight User/Group identity for all destination types.

  6. For User/Group, select the group from the resource selector popup.

  7. (Conditional) If you are adding more than one destination to an escalation level, use a unique user group for each destination. Using a group to which another destination under that escalation level belongs might result in incorrect notification numbers.

  8. Optional: To add information in the Notes tab, refer to Using Notes.

  9. Click OK.

To move or copy destinations:

  1. In the Notification resources tree, find a destination and drag it to a different escalation level. You can drag across groups if needed.

  2. Right-click the destination and choose Move to move it, Copy to make a separate copy, or Link to create a copy of the destination that is linked to the original destination.

    If you choose Copy, you create a separate copy of the destination that is not affected when the original destination is edited. If you choose Link, you create a copy of the destination that is linked to the original destination. Therefore, if you edit a linked destination, whether the original or the copy, all links are edited as well. When deleting linked destinations, you can either delete the selected destination or all linked destination copies.

To delete destinations:

  1. In the Notification resource tree, right-click a notification destination and choose Delete Destination.

  2. In the dialog box, click Yes.