Hi All –
I’ve had a couple questions conversations around ESA best practices and rule creation. One of the easier things a you can do to protect ESA when you’re creating complex rules, or rules that might be more experimental in nature, is to ensure that they’re tagged as Trial Rules.
When rules are configured as Trial Rules, they will all be disabled when ESA Memory reaches a configured threshold. Note, ALL rules configured as Trial Rules will be disabled if the memory reaches that threshold.
The Trial Rules functionality is an easy way to add a level of protection when you’re working with complex or experimental rules.
For more info, there’s a nice write up of ESA Trial Rules, as well as ESA in general, in the online SA Docs.
Please let me know if you have any questions about this topic (or any ESA topic).