Reporting: Rule Syntax

Document created by RSA Information Design and Development on Jul 29, 2016
Version 1Show Document
  • View in full screen mode

The rule syntax is very similar to that of Standard Query Language (SQL) in that fields are selected based on a WHERE clause and result sets are sorted and given a limit. When defining rules using IPDB and NetWitness data sources, the following are used:


Add a Tutorial to Your User Guide

Tutorials describes steps for completing an end-user task. To mark a tutorial, add any of the following tags to any page:

  • article:task-tutorial-beginner
  • article:task-tutorial-intermediate
  • article:task-tutorial-advanced

Add a Troubleshooting Page

Troubleshooting pages are for users to identify reasons and fixes for problems. To mark a troubleshooting page, add the tag article:task-troubleshooting to any page.

Add a Reference Page to Your User Guide

Reference pages list essential facts about a feature or system. To mark a reference page, add the tag article:reference-feature to any page.

Table of Contents

IPDB Rule Syntax

NWDB Rule Syntax



  • IPDB Rule Syntax

    This topic describes the supported rule syntax for the IPDB Extractor service through descriptions and examples of supported and unsupported syntax.

  • NWDB Rule Syntax

    This topic describes the rule syntax supported by NWDB rule syntax in the Reporting Engine.