Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: Rules from a single host, from a single user ID

$
0
0

Hey!

 

You can do this via the 'Advanced Correlation' tool within the Rule Builder, if you click the 'Advanced Correlation' button with the 'Correlation Time' widget:

 

 

You can then set the condition, such as the DestinationAccount and/or SourceMachine must be the same (or distinct):

 

 

Hope that helps!


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>