RSA Admin

Possible to reset 'Event Average'?

Discussion created by RSA Admin Employee on May 9, 2013



Im trying to create a correlation rule to trigger an alert for a percentage increase of events for a device.  however according to the online help the calculation to work out the event average is....


'number of events recieved for messageID since enVision started collecting data for that device' DIVIDED BY 'time period'


BUT  during the event collection I had a massive spike a year ago that will effect my daily and hourly average today!


SO can the average be reset?  how can I know what envision is using for the average at any time?


please help