Configure the occurrence settings

By default, a condition only has to occur once to satisfy part of a rule. However, you can change this using the occurrence setting. For example you might only want to know if an occurrence happens five times in thirty seconds.

To apply occurrence settings for this part of the rule, click the icon on the SEM rule builder tool bar.

If you change the number of times this condition occurs to satisfy this part of the rule, the window is expanded as shown below.

You can also specify additional conditions. For example the following would be true if the event occurred twice within ten minutes with the same DetectionIP.

You can additionally set a period that must elapse before this part of the rule can be triggered again by checking the Occurrence time box.