This topic describes the features of the Build Rule view and the actions that you can perform. Associated procedures are provided under Working with Reporting Rules
You can perform the following actions using the Rule panel:
- Define and save a rule.
- Reset the values of the rule.
- Test the correctness of the rule.
- Add the rule to a report.
- Add the rule to the alert queue.
- Add the rule to a chart.
The Build Rule view includes the following panels:
- Rule panel
- Meta panel
- Lists panel
The following figure shows the various panels of the Build Rule view.
The Rule panel allows you to create a rule for the selected database type. The supported rule types are:
- Netwitness DB
- Warehouse DB
The following figure displays the Rule panel.
The Meta panel provides a list of available meta types that you can use to build the rule. You can use the meta types in the Select, Where, and Then clauses. The Reporting Engine maintains an active list of the available meta names by continuously synchronizing with the data source to which it is connected.
The following figure displays the Meta panel.
|Choose||Based on the rule type that you have selected, the available data sources are displayed in the drop-down list of the Meta panel. Select the required data source. The available metas for the data source are displayed. Select a meta.|
|Filter||Filter the meta for a specific meta value.|
Note: If a meta is written in two different formats into the Security Analytics Warehouse (SAW). Reporting Engine discards such meta and they are not displayed in the Warehouse Rule Builder. Also, existing Warehouse Report or Rule referring to this Meta fails.
A List is a placeholder for a set of values that you can use in a meta or a variable. For example, you can define a list with all the whitelisted event source IP addresses. Once the List is defined then you can use the List name in the rule. This provides the flexibility of adding, modifying, and deleting the list values.
The Lists panel is a collection of Lists. The Reporting Engine maintains an active list of the available list names by continuously synchronizing with the collection to which it is connected.