Skip to main content
Get the results for a given query viewer ID.

​
Parameters

ParameterDescription
Disable SSL EnforcementEnable this option to skip SSL verification of the server’s certificate chain and host name. This may increase security vulnerabilities, but can be useful for testing or when custom verification is employed.
Query Viewer IDThe query viewer ID. Can be obtained by the List Query Viewers action.

​
Example Output

{
	"ArcSightESM": {
		"QueryViewerResults": [
			{
				"Attacker Address": "1.1.1.1",
				"Attacker Zone URI": "/All Zones/ArcSight System/Public Address Space Zones/E.I. duPont de Nemours and Co. Inc.",
				"End Time": "1589028174502",
				"Event ID": "12345678",
				"Name": "Login succeeded for user name 'admin'",
				"Start Time": "1589028174502"
			},
			{
				"Attacker Address": "2.2.2.2",
				"Attacker Zone URI": "/All Zones/ArcSight System/Public Address Space Zones/E.I. duPont de Nemours and Co. Inc.",
				"End Time": "1589028234536",
				"Event ID": "87654321",
				"Name": "Login succeeded for user name 'admin'",
				"Start Time": "1589028234536"
			},
			{
				"Attacker Address": "3.3.3.3",
				"Attacker Zone URI": "/All Zones/ArcSight System/Public Address Space Zones/E.I. duPont de Nemours and Co. Inc.",
				"End Time": "1589028294471",
				"Event ID": "14725836",
				"Name": "Login succeeded for user name 'admin'",
				"Start Time": "1589028294471"
			}
		]
	}
}

​
Workflow Library Example

Get Query Viewer Results with Arcsight Esm and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop