How to check in-memory tables in ESA?

[MaximilianoCitt]

I've a customer who has deployed the "user login baseline" rule into the ESA. 

What we need to know is the statistics taken by ESA for each user.

In 10.x we had esa-client, now I don't know if we have that tool to check cep memory tables.

Any suggestions?

Regards.

Max

[MaximilianoCitt · Accepted solution]

Just in case anyone else need it:

https://community.rsa.com/docs/DOC-110252#ViewNamedWindow 

[KarimBenzina]

Hi Maximiliano,

Based on the official documentation, you can even create a custom script to output the content of a named window in a json file from the shell command line.

[root@SA ~]# cat check-window-content.sh

connect --service correlation-server.7cc00298-f5a7-4359-b191-305c5b5f8307

cd /rsa/correlation/engine/execute-query

invoke '{"engineName":"e-s-a-prod-sa-managed", "query":"select * from Myfenetre"}'

[root@SA ~]#

[root@SA ~]# chmod +x check-window-content.sh

[root@SA ~]# time nw-shell @/root/check-window-content.sh >> contenu-fenetre-output.json

[MaximilianoCitt]

Thank you for your reply Karim!

in other hand, is there any kind of query to list all the named windows running in memory?

Regards,

Max