Documentation forSecurity Event Manager

Edit the expressions

To change the expression for a rule part, click the icon on the SEM rule builder tool bar. A popup window is displayed showing the components of the expression. For an entity, this will show two field: the entity name and whether or not the condition occurred. For an entity field, the following fields are displayed.