Create an Incident Family (Syslog Message) (ArcSight)

The Family attribute helps you organize your incidents. Create any Family that makes sense to you and your team. For a list of the Family codes provided by NNMi, Specify Category and Family Attribute Values for Organizing Your Incidents (Syslog Message) (ArcSight).

To create a new incident Family:

1. Navigate to the Incident Family form.

   1. From the workspace navigation panel, select the Configuration workspace.
   2. Expand the Incidents folder.

   3. Select Syslog Message Configurations .

   4. Do one of the following:

      • To create an incident configuration, click the New icon, and continue.
      • To edit an incident configuration, select a row, click the Open icon, and continue.
      • To delete an incident configuration, select a row, and click the  Delete icon.
   5. In the configuration form, locate the Family attribute.
   6. Click the  Lookup icon, and select  New.
2. Provide the required information (see table).
3. Click  Save and Close to save your changes and return to the previous form.

Family Attributes

Name	Description
Label	Family name. For example, Hardware Faults, or Cisco Error. Maximum size is 255 characters. Any character type is valid.
Unique Key	Caution: After you click  Save and Close, this value cannot be changed. Used as a unique identifier when exporting and importing configuration definitions. To ensure that the value you enter is unique, it is recommended that you use the Java name space convention when providing this value. It is also useful to include the label value as part of the unique key as shown in the following examples: com.<your_company_name>.nnm.trapConf.family.<family_label> com.<your_company_name>.nnm.eventConf.family.<family_label> com.<your_company_name>.nnm.inciConf.family.<family_label> The maximum length is 80 alpha-numeric characters, periods allowed, no spaces allowed.