ESM: Bulk Edit Event Source Attributes

Document created by RSA Information Design and Development on Jul 27, 2016
Version 1Show Document
  • View in full screen mode
 

You can select multiple event sources, or an entire group, or even all event sources for bulk editing. For example, you might want to change the Priority or the Manager for a large number of your event sources.

Note: You cannot select individual event sources across displayed pages. For example, if you have a group with 225 event sources, and your Page Size is 50, you can only select event sources from the currently displayed 50 items.

  If you want to edit items that span multiple pages, you can do the following:

  • In the browser, Increase the page size (the maximum is 500 entries on a single page). If your page size is small, you might be able to get all of your items on a single, larger page.
  • Create a new event source group that contains only the items that you want to bulk edit. Then, you can select all items for that group, rather than selecting individual items.
  • Bulk edit incrementally. On the first page, select the items that you want to edit. Make your edits, then go to the next page and repeat the process, until you have made all of your changes.

To bulk edit attributes for Event Sources:

  1. In the Security Analytics menu, select Administration > Event Sources.
  2. Select the Manage tab.
  3. Optionally, select an event source group.
  4. In the Event Sources panel, select one or more event sources to edit.

    Note: To select all event sources, select the box next to the Actions column in the last (far-right) column of the list table.

  5. Select the Edit icon 104ApplEdit.png from the menu bar.

    The Bulk Edit Event Source dialog is displayed.

    ES_BlkEdit.png

  6. Enter values for any of the available attributes. In the screen shot above, the Name and Priority attributes have been updated.
  7. When you have updated as many attributes as required, click Save.

Note: Mandatory fields cannot be edited; IP, IPv6, Hostname, Event Source Type, Log Collector, and Log Decoder. If you attempt to edit any of these fields, you receive this message: This field cannot be changed while editing an event source.

You are here: Procedures > Manage Event Sources > Bulk Edit Event Source Attributes

Attachments

    Outcomes