Incident Management: Aggregation Rules Tab

Document created by RSA Information Design and Development on Oct 24, 2017•Last modified by RSA Information Design and Development on Jan 29, 2018

Version 2Show Document

Like • Show 0 Likes0
Comment • 0
View in full screen mode

This topic covers information of parameters required in creating and managing aggregation rules for automating the incident creation process as part of the incident management workflow.

To access the Aggregation Rules view, in the Security Analytics menu, select Incidents > Configure > Aggregation Rules. The Aggregation Rules view is displayed.

Features

The Aggregation Rules tab consists of a grid and toolbar.

Aggregation Rules Grid

The following table lists the parameters that need to be provided for creating new aggregation rules.

Parameter	Description
Order	Denotes the order in which the rule is placed. The rule order determines which rule takes effect if the criteria for multiple rules match the same alert.
Name	Displays the name of the rule.
Enabled	Denotes whether the rule is enabled or not. The specifies the rule is enabled.
Description	Displays the description of the rule.
Last Run	Displays the time when the rule was last run. This value is reset once a week.
Matched Alerts	Displays the number of matched alerts. This value is reset once a week. To change the setting, see the Set Counter for Matched Alerts and Incidents topic in the Incident Management Configuration Guide.
Incidents	Displays the number of incidents created by the rule. This value is reset once a week. To change the setting, see the Set Counter for Matched Alerts and Incidents topic in the Incident Management Configuration Guide.