Window Operation - Novell SENTINEL 6.1 SP2 - REFERENCE GUIDE 02-2010 Reference Manual

filter(e.evt="File Access" and not(e.sun inlist AuthorizedUsers))
ISNULL Operator
The isnull operator returns true if the metatag value is equal to NULL.
Example:
Filter(isnull(e.SIP))
Output Sets
The output of a filter is either the empty set (if the Boolean expression evaluates to false) or a

set containing the current event and all of the other events from the incoming set (if the
Boolean expression evaluates to true).
If filter is the last or only operation of a correlation rule, then the output set of the filter is used

to construct a correlated event. The trigger events are the filter operation output set of events
with the current event first.
If filter is not the last operation of a correlation rule (that is, filter is followed by a flow

operatior), then the output set of a filter is used as the input set to other operations (through the
flow operator).
Additional Information
The filter operator can be used to compare metatag values with other metatag values, for

example:
e.SourceIP=e.DestinationIP

4.3.2 Window Operation

Window compares the current event to a set of past events that are stored in a "window." The events
in the window can be all past events for a certain time period, or they can be filtered.
The Boolean expression is a composite of comparison instructions and match instructions with the
Boolean operators AND, OR and NOT.
The syntax for window is:
Window (<Boolean expression>[, <filter expression>, <evaluation period>)
Where
<Boolean expression> is an expression comparing a metatag value from the
current event to a metatag value from a past event (or a user-specified
constant)
<filter expression> is optional and specifies filter criteria for the past
events
<evaluation period> specifies the duration for which past events matching the
filter expression are maintained, specified in seconds (s), minutes (m), or
hours (h). If no letter is specified, seconds are assumed.
For example, this rule detects whether the current event has a source IP address in the specified
subnet (10.0.0.10/22) and matches an event(s) that happened within the past 60 seconds.
window(e.sip = w.sip, filter(e.sip match subnet (10.0.0.10/22),60)
44 Sentinel 6.1 Reference Guide