Configuring A Correlated Event - Novell SENTINEL RAPID DEPLOYMENT 6.1 - 12-2009 User Manual

Default Settings
Table 4-4
Field Name
Severity
Event Name
Message
Resource
SubResource

4.6.1 Configuring a Correlated Event

Configure Correlated Event
Figure 4-2
NOTE: This type of action can only be used in Correlation deployments.
To override the default values for the correlated event created when a rule fires, an action can be
created to populate the following fields in the correlated event:
Severity
Event Name
Message
Resource
SubResource
Default Values
4
Final Event Name
<message>
Correlation
<Rule Name>
Correlation Tab 103