Event Fields

All operations function on event fields, which may be referred to by their labels or by their metatags within the correlation rule language. For a full list of labels and metatags, see Sentinel Metatags in Sentinel 6.0 User's Reference Guide. The label or metatag must also be combined with a prefix to designate whether the event field is part of the incoming event or a past event that is stored in memory.

Examples:

e.DestinationIP (Destination IP for the current event)

e.dip (Destination IP for the current event)

w.dip (Destination IP for any stored event)

 

WARNING:

If you rename the label of a metatag, do not use the original label name when creating a correlation rule.