000026763 - How to modify the formula used to calculate the fields in Security Analytics Link in RSA SecOps

The Security Analytics Link field is a calculated field, as shown below.

"<a target='_new' href='https://" & "[SA Host]" & "/investigation/" & "[Device ID]" & "/navigate/query/alert=" & [Alert Name] & "/date/" & YEAR([AlertTimestampBefore - DND]) & "-" & MONTH([AlertTimestampBefore - DND]) & "-" & DAY([AlertTimestampBefore - DND]) & "T" & HOUR([AlertTimestampBefore - DND]) & ":" & MINUTE([AlertTimestampBefore - DND]) & ":00z" & "/" & YEAR([AlertTimestampAfter - DND]) & "-" & MONTH([AlertTimestampAfter - DND]) & "-" & DAY([AlertTimestampAfter - DND]) & "T" & HOUR([AlertTimestampAfter - DND]) & ":" & MINUTE([AlertTimestampAfter - DND]) & ":00z" & "'>Click Here"</a>"

To modify this field, perform the steps below.

1. Navigate to Administration -> Manage Applications.
2. Click on Security Alerts.
3. Click on the Fields tab.
4. Click on Security Analytics Link.
   
5. Go to the Calculation Properties section.
6. In the Formula section, click Edit Formula.
7. Make your modifications and click OK. If [SA Host] or [Device ID] is replaced with a static value, when the formula is recalculated, all links will be created with the static value.
   
8. Go to the Calculation Properties section.
9. In the Recalculation section, choose Always.
10. Click Save. All fields will be recalculated.
    

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.