This topic introduces application rules and describes features that apply specifically to application rules.
The main Rules Tab section describes the toolbar common to all types of rules. This section introduces the user interface for application rules.
You can display this view by doing the following:
- In the Security Analytics menu, select Administration > Services.
- Select a service and >View > Config.
The Config view for the selected service is displayed.
- Click the App Rules tab
This is an example of the App Rules tab.
This is an example of the Rule Editor dialog for an application rule.
Application Rules Grid Columns
The Rule Editor dialog provides the fields and options needed to define an application rule.
|Rule Name||The descriptive name that identifies the rule.|
|Condition||The definition of the condition that triggers an action when matched. You can type directly in the field or build the condition in this field using meta from the Intellisense window actions. As you build the rule definition, Intellisense displays syntax errors and warnings.|
The following table describes the Session Data actions and options.
|Stop Rule Processing||If checked, further rule evaluation ends if the rule is matched, and the session is saved in accordance with the session action. If not checked, rule evaluation continues until all rules are evaluated.|
|Keep||The packet payload and associated metadata are saved when they match the rule.|
|Filter||The packet is not saved when it matches the rule.|
|Truncate||The packet payload is not saved when it matches the rule, but packet headers and associated metadata are retained.|
|Alert and Alert On||If Alert is checked, the packet generates a custom alert when metadata matches the rule. You can select the name of the alert in the Alert On field.|
|Forward||Enables the performance of syslog forwarding when the log matches the rule.|
|Transient||Prevents the alert metadata that is created from being written to the disk.|
The following table describes Rule Editor dialog actions.
|Reset||Resets the contents of the dialog to their values before editing; changes are discarded.|
|Validate||Validates that the rule syntax is correct.|
|Cancel||Cancels any edits and closes the Rule Editor dialog.|
|OK||Saves the new rule or edited rule, and adds it to the rules grid. The Rule Editor dialog closes.|