RSA Admin

Correlation rules

Discussion created by RSA Admin Employee on Apr 12, 2010
Latest reply on Apr 13, 2010 by RSA Admin

Hi people,

 

today I have created a rule stating that if any new devices onboard or deleted from the existing list To get alerted on that. I was confused to select which event category I need to select. (I selected the system crypto. But that didn't work. I deleted a device and added the same device still my rules is not working. When I din that it asked me to restart INC alert and collector alert service I did that but still no luck could anyone please help me to sort out this

 

thanks in advance for help

regards

shri

Outcomes