I am trying to automate the SIEM triage process for the Arcsight alerts.
I can see the Arcsight alerts as xml format in swimlane. Now I need to parse the different fields in the xml input so that i can display it for the analyst. I tried a custom python script for this , the script is returning results in the debugger , but in the actual record when I run this , the result is empty for some fields such as base event ids , not throwing any error also.
Do you have any inputs for this ? has any one faced this before or do you have any working script for this ?