Syslog Message Configuration Form (ArcSight)

To configure incidents originating from syslog messages:

1. Navigate to the Syslog Message Configuration form:

   1. From the workspace navigation pane, select the  Configuration workspace.
   2. Expand the Incidents folder.
   3. Select Syslog Message Configurations.

2. Make your configuration choices (see table).

   Note If you want to add or edit a Syslog Message incident configuration, verify that Enabled   is selected.

   1. To add a Syslog Message incident configuration, click the  New icon, and continue.
   2. To edit a Syslog Message incident configuration, double-click the row representing the configuration you want to edit, and continue.
   3. To delete a Syslog Message incident configuration, click the  Delete icon.
3. Click  Save and Close to save your changes and return to the previous form.

Tasks for Syslog Message Incident Configuration

Task	How
Specify the Incident Configuration Name (Syslog Messages) (ArcSight)	Use the Basics group of the Syslog Message Configuration form. Specify a name that helps you to identify the configuration for subsequent use.
Specify whether you want to enable this configuration.	In the Basics group of the Syslog Message Configuration form, verify that Enable is selected for each configuration you want to use.
Specify Category and Family Attribute Values for Organizing Your Incidents (Syslog Message) (ArcSight)	Use the Basics group of the Syslog Message Configuration form. You can organize your incidents using Category and Family.
Specify the Incident Severity (Syslog Message) (ArcSight)	Use the Basics group of the Syslog Message Configuration form. Possible Severity values include: Normal, Warning, Minor, Major, and Critical.
Specify Your Incident Message Format (Syslog Message) (ArcSight)	Use the Basics group of the Syslog Message Configuration form. The message format determines the message to be displayed for the incident.
Specify a Description for Your Incident Configuration (Syslog Messages)(ArcSight)	Use the Basics group of the Syslog Message Configuration form. Provide a meaningful description.
Specify an Author for Your Incident Configuration (Management Events)	Use the Basics pane of the Syslog Message Configuration form to indicate who created or last modified the event. If the Author attribute value is Network Node Manager, any changes are at risk of being overwritten in the future. Click  Lookup and select  Show Analysis to display details about the currently selected Author. Click  Quick Find to access the list of existing Author values. Click  New to create an Author value.

After you complete the Basic Configuration for the Syslog Message incident, you can also choose to configure the information described in the following table.