A composite rule is comprised of two or more subrules. A composite rule can be defined so that all or a specified number of the subrules must fire within the defined time frame. Composite rules have an optional
field, which can be any populated field from the events.NOTE:When a subrule is used to create a composite rule, a copy of the subrule is added to the composite rule’s definition. Because a copy is added, changes to the original subrule do not affect the composite rule.
To create a composite rule:
Open the Correlation Rule Manager window and select a folder from the drop-down list to which this rule is added.
Click the
button located on the top left corner of the screen. The Correlation Rule window displays. Select .In the Composite Rule window, click
to select sub rules to create a composite rule. The Add Rule window displays.Select a rule or a set of rules nd click
.Set parameters for the rule to fire.
To group event tags according to the attributes, click
. The Attribute window displays.Select the attribute you want, then preview the rule in RuleLg preview box.
Click
.The Update Criteria window displays.Update criteria for the rule to fire and click
.Provide a name for this rule. You have an option to modify the rule folder.
Provide a rule description and click
.You have an option to create another rule from this wizard. Select your option and click
.For trademark and copyright information, see Legal Notices.