Documentation forSecurity Event Manager

Test, enable, and disable rules in SEM

About selecting rules to test, enable, or disable

  1. On the SEM Console, click the Rules tab.
  2. To disable a rule, click the enabled toggle button next to a rule. To edit, delete, and toggle test mode, click the vertical ellipsis next to a rule.

    To learn more, see Create rules.

Enable rules from the rules builder

  1. On the SEM Console, select Rules.
  2. Click the vertical ellipsis next to a rule, and then select Edit rule.

  3. Click Next.
  4. Under details and actions, click the toggle button to enable the rule after saving, and then click Save.

To learn more, see Create rules.

Testing rules in SEM

Before you put a rule into production, try it out in test mode. In test mode, the SEM Manager processes the rule alert messages, but does not execute any rule actions. This lets you see how the activated rule will behave without disrupting your network.

Enable or disable test mode in the Rules list

  1. On the SEM Console, select Rules.
  2. To disable a rule, click the enabled toggle button next to a rule. To enable or disable test mode, click the vertical ellipsis next to a rule, and then toggle Test mode.

    To learn more, see Create rules.

Enable or disable test mode from the rules builder

  1. On the SEM Console, click the Rules tab.
  2. Click the vertical ellipsis next to a rule, and then select Edit rule.

  3. Click Next.
  4. Under details and actions, click the toggle button to enable or disable test mode, and then click Save.

To learn more, see Create rules.

Disable rules in SEM to stop them from processing

The SEM Manager continues to use active rules if they are enabled. Turn off rules by disabling them.

Disable rules from the Rules list

  1. On the SEM Console, select Rules.
  2. To disable a rule, click the enabled toggle button next to the rule.

    To learn more, see Create rules.

Disable rules from the Rules builder

  1. On the SEM Console, select Rules.
  2. Click the vertical ellipsis next to a rule, and then select Edit rule.

  3. Click Next.
  4. Under details and actions, toggle off the Enable the rule after saving, and then click Save.

To learn more, see Create rules.