Table of Contents
Advertisement
If nothing is selected, a Correlated event with default values is created.
5 Click Deploy.
To undeploy a single rule:
1 In the Correlation Engine Manager, right-click the rule and select Undeploy Rule.
or
In the Correlation Rule Manager, select the rule and click the Undeploy rule link.
To undeploy all correlation rules:
1 Open the Correlation Engine Manager window.
2 Right-click the Correlation engine and select Undeploy All Rules.
4.3.8 Enabling and Disabling Rules
1 Open the Correlation Engine Manager window.
2 Right-click the rule or set of rules and select Enable Rule or Disable Rule.
4.3.9 Renaming and Deleting a Correlation Rule
To rename a correlation rule:
NOTE: You must undeploy a rule before you rename or delete the rule.
1 Open the Correlation Rule Manager window and select the rule you want to rename.
2 If the rule is deployed, click the Undeploy Rule link to undeploy the rule.
3 Click the View/Edit link. In the General Description tab, change the name of the Correlation
rule.
4 Click OK.
To delete a correlation rule:
1 Open the Correlation Rule Manager window and select the rule you want to delete.
2 If the rule is deployed, click the Undeploy Rule link to undeploy the rule.
3 Click the Delete link. Click Yes when the system prompts for confirmation.
4.3.10 Sorting Correlation Rules
To sort the list of correlation rules, click the
Manager window.
96
Sentinel 6.1 Rapid Deployment User Guide
Sort button at the top left of the Correlation Rule
Advertisement
Table of Contents
