I've a customer who has deployed the "user login baseline" rule into the ESA.
What we need to know is the statistics taken by ESA for each user.
In 10.x we had esa-client, now I don't know if we have that tool to check cep memory tables.
Any suggestions?
Regards.
Max
Hi Maximiliano,
Based on the official documentation, you can even create a custom script to output the content of a named window in a json file from the shell command line.
[root@SA ~]# cat check-window-content.sh
connect --service correlation-server.7cc00298-f5a7-4359-b191-305c5b5f8307
cd /rsa/correlation/engine/execute-query
invoke '{"engineName":"e-s-a-prod-sa-managed", "query":"select * from Myfenetre"}'
[root@SA ~]#
[root@SA ~]# chmod +x check-window-content.sh
[root@SA ~]# time nw-shell @/root/check-window-content.sh >> contenu-fenetre-output.json
Thank you for your reply Karim!
in other hand, is there any kind of query to list all the named windows running in memory?
Regards,
Max
Just in case anyone else need it:
https://community.rsa.com/docs/DOC-110252#ViewNamedWindow