RSA Admin

Setting Filters

Discussion created by RSA Admin Employee on May 21, 2010
Latest reply on Oct 4, 2010 by RSA Admin



Ive created a correlation rule to firstly capture a 626 event (account enabled) and then a 528 (suc login) For some reason i cant add a filter the only option is CONTENT. Any ideas? The variables are available in the manager variables section. And im sure that "Username" is part of both events.