SN08: Primer: Writing Rules Not Meant to be Broken

Document created by jmerrill on Sep 9, 2010Last modified by jmerrill on Jul 8, 2014
Version 2Show Document
  • View in full screen mode

SN08
Primer: Writing Rules Not Meant to be Broken
Speaker:
Javier Inclan, Senior Instructor, ArcSight
Level: Basic
Rules can help you determine what to investigate. This primer demonstrates how to construct rules. It will focus on what to consider when building rules and how to use rules to identify events that require further investigation.

 

 

Outcomes