Documentation forSecurity Event Manager

Create a new rule

  1. On the SEM Console, click the Rules tab.
  2. On the Rules toolbar, click Create new rule.

  3. Drag one or more values into the rule definition builder. The drag panel on the left contains searchable filter values that you can drag into the rule definition builder. Expand a rule values group to select a value, or locate your value by entering a term in the search field.

    When you drag a value into the filter builder, the correct drop location is illuminated with a blue line.

  4. Click the rule definition icon, and then define the condition.
  5. From the drop-down list, select an option, enter a specific value or keyword directly.

    You can also mouse over a value to expose the rule builder toolbar where you can add or drag rule expressions, apply occurrence settings , edit expressions , and delete expressions .

  6. To change the And operator, click And, and then select Or.

  7. Click the occurrence settings icon to set the number of times the conditions must happen within a designated time and response window.

    Set a time when the rule will not trigger actions.

  8. Click Next.

  9. Under Details and actions, enter a rule name and description.
  10. From the drop-down list, select a tag for the rule.

    Tags make it easier to catalog and find rules.

  11. Click a toggle button to enable the rule after saving, or to enable in test mode.

    Rules in test mode will not trigger actions. This lets you see how the activated rule will behave without disrupting your network. You can Identify test mode rules in your list by the Test icon .

  12. To add an action when the rule triggers, click Add new action.

    To save a rule without adding an action, turn of the Enable rule after saving toggle button.

  13. Enter a search term, or select an action from the list, and then click Next.
  14. Define the trigger action, and then click Add.

    SEM provides over 30 actions that can be triggered within rules, ranging from Sending a popup message to Disabling Networking. For each the procedure is similar: select or enter the required parameters, and click Add.

  15. Click Create.
  16. To edit, delete, and toggle test mode, click the vertical ellipsis next to a rule.