Import a text file to create a User Defined Group (UDG) in SEM

10/9/2018 8:20 PM

10/9/2018 8:20 PM

This article applies to Security Event Manager (formerly Log & Event Manager).

This process will cover how to import a text file to create a User Defined Group.

Security Event Manager

To prepare the file:

1. Create a .txt file locally on the computer from where you would like to import the group.
2. The first line should contain three parts:
   1. UDG,Group Name,Description
   2. All files first line should always begin with UDG, followed by the name of the group as it should appear in the SEM and finally the description separated by commas.
   3. Example: UDG,My Import Group,My Import Description
3. The next lines will contain the data:
   1. Name, Data, Description
   2. The next lines will be the data as it will appear in the SEM. Name is the common name how you will reference the data. Data is the information the SEM will use in rule correlations. Description is a notes field for your reference.
   3. Example:  Bob's Machine, <Client's IP address>, This is the IP for Bob's Machine
4. Save the file as a .txt file.

To import the file:

1. Sign into the SEM Web or AIR console.
2. In the top navigation bar, click Build and Groups.
3. On the right side there is a Plus icon to Add and a Gear icon.
4. Click the Gear icon and select Import.
5. Browse to the file and select Open.
6. The User Defined Group should now appear in the Groups view.