Documentation forSecurity Event Manager

Test, enable, and disable rules in SEM

See Create a new rule for instruction on how to create a rule.

  1. Log in to the SEM Console.

  2. On the toolbar, click the Rules tab.
  3. To disable a rule, click the enabled toggle button next to a rule. To edit, delete, and toggle test mode, click the vertical ellipsis next to a rule.

Enable rules from the rules builder

  1. Log in to the SEM Console.

  2. On the toolbar, click Rules.
  3. Click the vertical ellipsis next to a rule, and then select Edit rule.

  4. Click Next.
  5. Under details and actions, click the toggle button to enable the rule after saving, and then click Save.

Test rules in SEM

Before you put a rule into production, try it out in test mode. In this mode, the SEM Manager processes the rule alert messages, but does not execute any rule actions. This process allows you to see how the activated rule will behave without disrupting your network.

Enable or disable test mode in the Rules list

  1. Log in to the SEM Console.

  2. On the toolbar, select Rules.

  3. To disable a rule, click the enabled toggle button next to a rule.

    To enable or disable test mode, click the vertical ellipsis next to a rule, and then toggle Test mode.

Enable or disable test mode from the rules builder

  1. Log in to the SEM Console.

  2. On the toolbar, click the Rules tab.
  3. Click the vertical ellipsis next to a rule, and then select Edit rule.

  4. Click Next.
  5. Under Details and actions, click the toggle switch to enable or disable test mode, and then click Save.

Disable rule processing in SEM

The SEM Manager continues to use active rules if they are enabled. Turn off rules by disabling the rules.

Disable rules from the Rules list

  1. Log in to the SEM Console.

  2. On the toolbar, click Rules.
  3. To disable a rule, click the enabled toggle button next to the rule.

    See Create a new rule for more information.

Disable rules from the Rules builder

  1. On the SEM Console, select Rules.
  2. Click the vertical ellipsis next to a rule, and then select Edit rule.

  3. Click Next.
  4. Under details and actions, toggle off the Enable the rule after saving, and then click Save.