Need to Create a Rule for device not sending logs for more than 1 hour in RSA Envision

[RSAAdmin]

Hi All,

Can anyone help me to write a correlation rule for the device not sending logs for more than 1 hour. I already have rule for device not sending logs for more than 4 hours, but the client requirement is that he wants the alert for the devices not sending logs for more than 1 hour.

Any help would be greatful.

Regards,

Samad M

[areebasad]

Samad,

Try the Attached Correlation Rule.

Regards

[RSAAdmin]

Hi Areeb,

Thanks for the info.

Would be greatful if you can share the html file for the same.

Thanks,

Samad

[areebasad]

Hi,

Here is the HTML

[RSAAdmin]

Thanks Areeb...I will Check this and update.