Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Alerting: Advanced EPL Rule Tab

Document created by RSA Information Design and Development Employee on Sep 12, 2017Last modified by RSA Information Design and Development Employee on Nov 11, 2020
Version 17Show Document
  • View in full screen mode

The Advanced EPL Rule tab enables you to define rule criteria with an Event Processing Language (EPL) query.

What do you want to do?

Role I want to ...Show me how
Content ExpertDefine an Advanced EPL rule.Add an Advanced EPL Rule
Content ExpertTest the Advanced EPL rule logic.Validate an Advanced EPL Rule
Content ExpertSee examples of an Advanced EPL Rule.Example Advanced EPL Rules
Content ExpertSee best practices for writing Advanced EPL Rules.ESA Rule Writing Best Practices

Related Topics

Quick Look

To access the Advanced EPL Rule tab:

  1. Go to (Configure) > ESA Rules.

    The Configure view is displayed with the Rules tab open by default.

  2. In the Rule Library toolbar, select Add list icon  > Advanced EPL.

    The Advanced EPL Rule tab is displayed.

The following figure shows the Advanced EPL Rule tab.

Advanced EPL Rule

The following figure shows the Advanced EPL Rule tab scrolled down with the Test Rule section in view.
Advanced EPL Rule tab showing the Test Rule section

The following table lists the parameters in the Advanced EPL Rule tab.

Rule NamePurpose of the ESA rule.
Description Summary of what the ESA rule detects.
Trial RuleDeployment mode to see if the rule runs efficiently.
Memory Threshold(This option applies to version 11.5 and later.) The maximum memory usage allowed for this rule in MB. Add Memory Thresholds to ESA rules that use memory. For example, if a rule contains windows or pattern matching, configure a memory threshold for that rule. If the configured memory threshold is exceeded, it gets disabled individually and an error is displayed for that rule on the (Configure) > ESA Rules > Services tab.
New rules default to a 100 MB memory threshold. Rules that existed before version 11.5 do not have a default value and a memory threshold is not set.
Alert(This option applies to version 11.3 and Later.) When selected, the alert is sent to Respond. If the checkbox is cleared, an alert will not be sent to Respond.
To turn alerts on or off for ALL rules, see the ESA Configuration Guide.
SeverityThreat level of alert triggered by the rule.
QueryEPL query that defines rule criteria.

Notifications Section

In the Notifications section, you can choose how to be notified when ESA generates an alert for the rule.

For more information on the alert notifications, see Add Notification Method to a Rule.

The following figure shows the Notifications section.

Notifications section

Add icon To add an alert notification type.
Delete icon To delete the selected alert notification type.
OutputAlert notification type. Options are:
  • Email
  • SNMP (This option is not supported in NetWitness Platform version 11.3 and later.)
  • Syslog
  • Script
NotificationName of previously configured output, such as an email distribution list.
Notification ServerName of server that sends the output.
TemplateName of template for the alert notification.
Output Suppression of everyOption to specify alert frequency.
MinutesAlert frequency in minutes.

Enrichments Section

In the Enrichments section, you can add a data enrichment source to a rule.

For more information on the enrichments, see Add an Enrichment to a Rule.
The following figure shows the Enrichments section.
Enrichments section


Add icon

To add an enrichment.

Delete icon

To delete the selected enrichment.
OutputEnrichment source type. Options are:
  • In-Memory Table (Ad hoc only - Recurring In-Memory Tables are no longer supported in version 11.3 and later.)
  • GeoIP

Enrichment Source

Name of previously configured enrichment source, such as a .CSV filename for an In-Memory Table.
ESA Event Stream MetaESA meta key whose value will be used as one operand of join condition.

Enrichment Source Column Name

Enrichment source column name whose value will be used as the other operand of the join condition.

Test Rule Section

Note: The Test Rule section is available in NetWitness Platform 11.5 and later.

In the Test Rule section, you can validate your ESA rule to determine if the rule logic is working as expected before deploying the rule.

Advanced EPL Rule - Test Rule section

ESA ServiceSelect the ESA Correlation service to process the rule.
Input DataEnter the input events to test the rule. You can download the events from the Investigate view in JSON format, copy the events, and paste them in this field.
Output DataAfter you select an ESA Correlation service, input data, and click the Test Rule button, you can view the output of the rule here and verify that the rule is working according to your requirements. You can view the alerts in the output, but this test does not send any alert notifications. If you want to view all of the debug information for the test, include an @Audit(‘stream’) annotation to your rule query.

The following table describes the test rule output Engine Stats.

Engine VersionEsper version running on the ESA service
Events OfferedNumber of events processed by the ESA service since the last service start
Offered RateThe rate that the ESA service processes current events / The maximum rate that the ESA service processed events
Runtime ErrorsIf applicable, this field can contain a link to runtime error messages related to the ESA rule deployment.

The following table describes the test rule output Rule Stats.

DeployedA green checkmark indicates that the rule is deployed on the selected ESA service.
Statements FiredThe number of statements that fired the alerts
Alerts FiredThe number of alerts generated from the test data
Events in MemoryThe number of events placed in memory by the rule
Memory UsageThe total amount of memory used by the rule
CPU %The percentage of the deployment CPU used by the rule. For example, a deployment with 1 rule shows 100% CPU usage for that rule and a deployment with two equally CPU heavy rules show 50% each.
Events MatchedThe number of events that matched the rule
Alerted EventsIf applicable, this field can contain a link to events that caused an alert.
Runtime ErrorsIf applicable, this field can contain a link to runtime error messages related to the rule.
Debug LogsThis field contains a link to Esper debug (audit) logs.


Click Show Syntax to view the EPL syntax of conditions, statements, and debugging parameters. It also provides a warning when the syntax is invalid. For more information, see Rule Syntax Dialog.

You are here
Table of Contents > ESA Alert References > Advanced EPL Rule Tab