Novell SENTINEL 6.1 SP2 - 02-2010 User Manual page 328

To Deploy the Simple Correlation Rule:
1 Click the Correlation tab and highlight Correlation Rule Manager in the navigation bar.
2 Click Tutorial_SourcePort_DestinationPort (this is the name of the rule from the previous
example) > Deploy Rule.
3 (optional) In the Deploy Rule window, you can add an action. This allows you to:

Configure Correlated Event

Add to Dynamic List

Remove from Dynamic List
Click Next. The rule indicates deployed by the color green.
To view what events triggered your correlated event
1 Right-click the correlated event and select View Trigger Events to see how many events (could
be more than 1) triggered this correlation rule.
328 Sentinel 6.1 User Guide

Execute a Command

Send Email

Create Incident