RSA Admin

Correlation Rule

Discussion created by RSA Admin Employee on Dec 10, 2012
Latest reply on Dec 17, 2012 by DelfinAbzueta

One message text :



Message Text

- Exception:Authentication failed. Please try again: reason: SEC0005E



Logic : I am capturing SEC0005e



Second Message text :


Message Text :  - Login:abhishek


Logic : I am capturing Login ID .




Requirement :  Now I want these two message text comes in one alert as a single mail .




I have tried to configure a correlation rule with two circuits have above two logics and using : OR , AND , Followed by logic gates but either

i am getting two seperate alerts or i am getting only on the message text in onle alert .



Pls . suggest.