Documentation forSecurity Event Manager

Create a rule from a filter

From the Filters pane, you can create a new rule based on any existing filter with a single click. This allows you to set alerts for specific event activity without manually duplicating filter values in the custom rule builder.

  1. Log in to the SEM Console.

  2. On the toolbar, click Live Events.
  3. In the Filters pane, scroll down to locate your filter.
  4. Hover over the filter to expose the vertical ellipsis.
  5. Click the ellipsis and select Send Filter to Rule.

    The rule builder displays the existing filter values.

  6. To complete the rule configuration.

    See Create a new rule for instructions.

    If you apply rule definition changes to a rule created from a filter, the changes are not reflected in the existing filter. If the filter changes, the associated rule is not updated with the filter changes.