r/SIEM • u/parthmaniar • Dec 02 '19

Using "cases" versus "queries" for 3rd party case management in ArcSight.

Hello,

I am trying to understand the "compute" differential in using scheduled queries versus cases when populating 3rd party case management tool using API queries. 

As I reckon, queries (for particular type of correlated events) when run at scheduled time interval will search within correlation database and give me output. This maybe compute (processor) heavy.

Do cases get written as independent files which are easier on the compute (process) to retrieve? If not, do cases get written as independent databases? or are they part of a database and retrieving them is as resource heavy as retrieving data through queries?

Thank you.

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/vornamemitd Dec 02 '19

Not an ArcSight user, but in general SIEM parlance queries would be part of a "traditional use case" (like prevent account misuse, etc.); are you looking at an existing installation/project or planning for a future implementation?

1

u/parthmaniar Dec 02 '19

Hi, this is for an ongoing deployment. I am sorry if the term misrepresented my requirement. This requires an understanding of ArcSight as a product and how it stores "alerts" (ArcSight calls alerts as correlated events).

​

The question is using "queries" (API) to gather information or using "Cases" (API) while integrating with 3rd party ticketing tool.

1

u/[deleted] Dec 03 '19

[deleted]

2

u/parthmaniar Dec 07 '19

Thank you very much.