RSA Admin

Testing/Developping/Debugging Correlation rules

Discussion created by RSA Admin Employee on Aug 11, 2008
Latest reply on Sep 18, 2009 by RSA Admin

Is there a mechanism available that can allow quicker development of correlation rules than restarting views and reemitting messages into the envision after every edit? For example, something like the UDS console that could analyze a message dump and tell if the messages will trigger a specific correlation rule?

 

 

Outcomes