This topic provides a brief description about a rule. A rule is the basic and essential building block in the Reporting module. You must create a rule which can be used in a Report, Chart or Alert.
Building Blocks of a Rule
A rule represents a unique query that detects and summarizes the requested information within a collection of network data. For example, you can write a rule to view the top 20 web addresses your users visit daily or a rule to detect the presence of clear text authentication to their high valued assets.
The rule syntax is very similar to that of Standard Query Language (SQL) where you can use the SELECT clause, WHERE clause, sort and group options and limits for the result set. A rule consists of the following: