Correlation Engine Is Stopped; Correlation Rule; B.7.5 Correlation Rule; Correlation Rule Configuration - Novell SENTINEL RAPID DEPLOYMENT 6.1 - 12-2009 User Manual

B.7.4 Correlation Engine is Stopped
This event is sent out when the engine changes state from running to stopped.
Correlation Engine : Correlation Engine is Stopped
Table B-72
Tag Value
Severity 1
Event Name EngineStopped
Resource CorrelationEngine
SubResource CorrelationEngine
Message Correlation Engine has stopped processing events.

B.7.5 Correlation Rule

Correlation Engine : Correlation Rule
Table B-73
Tag Value
Severity
Event Name New/Update/Remove
Resource Correlation
SubResource CorrRule
Message Rule Name: <name> Type: <type> Rule Id: <ID>
B.7.6 Correlation Rule Configuration
Correlation Engine : Correlation Rule Configuration
Table B-74
Tag Value
Severity
Event Name New/Update/Remove
Resource Correlation
SubResource CorrRuleConfig
Message Correlation Rule Config ID: <ID> Rule Definition ID: {1} Name: <name> Active: {3}
System Events for Sentinel 441