Novell SENTINEL RAPID DEPLOYMENT 6.1 - 12-2009 User Manual page 300

5a4 In the Process Variables window, select the Variable Type as String.
5a5 Set the Default Value to yes.
5a6 (Optional) Under the Description tab, specify Initial evaluation of events to
determine if there has been an attack.
5a7 Click OK.
5a8 Select the newly created association, then click
until the step is renamed.
OK
5b Manual Step-1 to Collect Data:
5b1 Set the Role to Analyst.
5b2 Click Associate.
5b3 Select Hacked, then click OK.
300 Sentinel 6.1 Rapid Deployment User Guide