Creating or Editing a Profile

A profile is a set of filters that define what fields to include in your pattern search, and the scope and properties of a pattern. It also specifies the time period to search. Profiles can be general or specific. Typically you would use several different profiles to define the parameters of snapshots, which collect all the events in the specified time frame and evaluates them according to the filters set in the profile.

Pattern Discovery profiles are in the \All Profiles\ArcSight System folder.

Use the following procedure to create a new profile:

  1. In the Navigator panel, go to Pattern Discovery and click the Profiles tab.
  2. Expand the Profiles resource tree. Right-click a group in the resource tree and select New Profile.
  3. In the Inspect/Edit panel on the Profile Editor Attributes tab, you can modify most of the values.

You cannot rename or delete profiles in the ArcSight System Profiles group. You can edit them, but Micro Focus recommends that you edit a copy you have pasted into another profiles folder. To use one of these profiles as is, see Taking a Snapshot.

Caution: You can delete or modify a profile if it has patterns and snapshots derived from it. However if you delete it, the patterns and snapshots that are derived from it no longer work and are not removed. If you modify it, they may not work as expected. Delete such patterns and snapshots when deleting their profile.

To copy and paste a profile to another folder, select the profile to copy. Go to Edit | Copy (Paste) or use Ctrl + C (V).