AnsweredAssumed Answered

ESA Rules.

Question asked by qMvwrYBSUGd5vvi1EvAlMGpVvBe4ZTwLi1lah6b7pkE= on Feb 12, 2016
Latest reply on Feb 12, 2016 by Jeff Shurtliff

Hello. Our config is only Concentrator and Packet decoder. We do not have ESA live account. Now I would like to know how we could create custom alerts using rule builder. I tried this way > Alerts > Configure > Rule library >  Rulebuilder > Conditions >

 

When I am trying to use metakeys it is not accepting metakeys. I am using correct syntax (ie tcp_dstport). My role permission is set to manage rules under my role by my administrator. Can any one help me with this please?

Outcomes