RSA Admin

Correlation Rule

Discussion created by RSA Admin Employee on Dec 10, 2012
Latest reply on Dec 17, 2012 by DelfinAbzueta

One message text :

 

 

Message Text

- Exception:Authentication failed. Please try again: reason: SEC0005E

 

 

Logic : I am capturing SEC0005e

 

 

Second Message text :

 

Message Text :  - Login:abhishek

 

Logic : I am capturing Login ID .

 

 

 

Requirement :  Now I want these two message text comes in one alert as a single mail .

 

 

 

I have tried to configure a correlation rule with two circuits have above two logics and using : OR , AND , Followed by logic gates but either

i am getting two seperate alerts or i am getting only on the message text in onle alert .

 

 

Pls . suggest.

Outcomes