Primer: Writing Rules Not Meant to be Broken
Speaker: Javier Inclan, Senior Instructor, ArcSight
Rules can help you determine what to investigate. This primer demonstrates how to construct rules. It will focus on what to consider when building rules and how to use rules to identify events that require further investigation.