000026763 - How to modify the formula used to calculate the fields in Security Analytics Link in RSA SecOps

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000026763
Applies ToRSA Security Analytics
RSA Security Analytics 10.2.5
RSA Security Analytics 10.3.0
RSA Security Analytics 10.3.1
RSA Security Analytics 10.3.2
RSA Security Analytics 10.3.3
RSA Security Analytics 10.3.4
RSA SecOps
RSA Archer
IssueHow to modify the formula used to calculate the fields in Security Analytics Link in RSA SecOps.
Resolution

The Security Analytics Link field is a calculated field, as shown below.



"<a target='_new' href='https://" & "[SA Host]" & "/investigation/" & "[Device ID]" & "/navigate/query/alert=" & [Alert Name] & "/date/" & YEAR([AlertTimestampBefore - DND]) & "-" & MONTH([AlertTimestampBefore - DND]) & "-" & DAY([AlertTimestampBefore - DND]) & "T" & HOUR([AlertTimestampBefore - DND]) & ":" & MINUTE([AlertTimestampBefore - DND]) & ":00z" & "/" & YEAR([AlertTimestampAfter - DND]) & "-" & MONTH([AlertTimestampAfter - DND]) & "-" & DAY([AlertTimestampAfter - DND]) & "T" & HOUR([AlertTimestampAfter - DND]) & ":" & MINUTE([AlertTimestampAfter - DND]) & ":00z" & "'>Click Here"</a>"



 



To modify this field, perform the steps below.


  1. Navigate to Administration -> Manage Applications.
  2. Click on Security Alerts.
  3. Click on the Fields tab.
  4. Click on Security Analytics Link.
  5. Go to the Calculation Properties section.
  6. In the Formula section, click Edit Formula.
  7. Make your modifications and click OK. If [SA Host] or [Device ID] is replaced with a static value, when the formula is recalculated, all links will be created with the static value.
  8. Go to the Calculation Properties section.
  9. In the Recalculation section, choose Always.
  10. Click Save. All fields will be recalculated.

 


If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Legacy Article IDa68084

Attachments

    Outcomes