Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: Recognizing A Sequence of Events

$
0
0

Aha.  Thanks for that.

 

So...  Based upon the Correlation image you included above, and assuming that URL-A and URL-B are different enough that they won't ever occur at the same time on a log record, will the rule ever fire? 

 

I've made a rule emulating your idea but it won't fire unless I remove one of the two URL filters.


Viewing all articles
Browse latest Browse all 5385

Trending Articles