Data substitution

[RSAAdmin]

I've found a need recently to want to enrich data just for reports by substituting more meaningful data in some of the fields (for instance, substituting "Critical" in the Severity field instead of 1 in a report for managment).

Has anyone else run into the same problem, and found a solution?

[RSAAdmin]

It is not really a problem.

It is more a factor of how the product was designed, and the use of the specific sql tables, as well as the pre-canned variables/fields included within the product.

I've had to do this many times.

I think with the rumoured new ability to develop your own sql tables and assign your own variables will mean that you can probably reduce the need to do this in the future.

[RSAAdmin]

It looks like there is a place in the XML files that allows you to do value mapping, and I think this gives me what I was looking for.  Is this how you were doing it, or did you just use an external program for changing the values around?  I think that it would work well for our UDS devices (since we tend to go very generic and not include every event), but it may be difficult to go through the existing devices and update.

You're right, though, it isn't really a problem, but it does seem like something that could be easier.  I hadn't heard the rumors of the custom sql tables -- I'll have to start listening closer!