Open the Correlation Rule Manager window and select a folder from the Folder drop-down list to which this rule is added.
Click the
button located on the top left corner of the screen.The Rule Wizard displays. Select one of the following rule types and follow the steps for that particular rule type:
Simple
Composite
Aggregate
Sequence
Custom/Freeform
Define the update criteria for the rule.
If you select Continue to perform actions every time this rule fires, the rule fires every time the criteria is met. If you select
, the event fires only once as per user-defined time period.All the other events that match the Correlation rule within the specified time are grouped together with this correlated event. This user-defined time period can be a certain number of seconds, minutes, or hours.
Click
.Provide the rule name. The syntax of the rule is checked at the time it is created.
Under
, select a Correlation rule folder in which to store the rule.Type the description of the rule.
Click
. The rule is created and displays in the Correlation Rules Manager window.Select
if you want to create another rule or select if you do not want to create another rule. Click .The rule types and the steps to create them are described in Creating Correlation Rules.
For trademark and copyright information, see Legal Notices.