securitysavy

Use Enhanced Taqgging for correlation rules?

Discussion created by securitysavy on Feb 24, 2012
Latest reply on Feb 27, 2012 by securitysavy

Is it possible to use the new Enhanced Tagging for correlation rules for alerting?  Right now I think I have it setup correctly but I'm not seeing alerts.

 

I'm thinking it may not be possible.  I note that the documentation does say it is for reports only.  But if that is true why would the variables be visible in the Correlation Rule builder?

Outcomes