RSA Admin

Is it possible to use same rule in different views, but for different device groups for each view?

Discussion created by RSA Admin Employee on Mar 11, 2010
Latest reply on Mar 29, 2010 by RSA Admin

Hi, 

 

Our enVision-solution integrates log sources for several of our customers. I would like to create one view for each customer, and then use the same correlation rules in each view, but they should of course only trigger for events belonging to the particular customer. 

 

For example

View_customer_1: Correlation_rule_1, filter on device group = customer 1

View_customer_2: Correlation_rule_1, filter on device group = customer 2

 

Is this (or something similar) possible? 

 

Best regards, Anne Siri

Outcomes