Rule Operations; Gate Operation - Novell SENTINEL 6.1 SP2 - REFERENCE GUIDE 02-2010 Reference Manual

<number of events> is an integer value specifying the number of matching
events that are necessary for the rule to fire
<evaluation period> specifies the duration for which past events matching the
filter expression are maintained, specified in seconds (s), minutes (m), or
hours (h).
discriminator is a field to group by
For example, this rule detects if 5 events with the same source IP address happen within 10 seconds.
trigger(5,10,discriminator(e.sip))
Output Sets
 If the specified count is reached within the specified duration, then a set of events containing all
of the events maintained by the trigger is output; if not, the empty set is output.
When receiving a new input set of events, a trigger first discards the outdated events (events

that have been maintained for more than the duration) and then inserts the current event. If the
number of resulting events is greater than or equal to the specified count, then the trigger
outputs a set containing all of the events.
If a trigger is the last operation (or the only operation) of a correlation rule, then the output set

of the trigger is used to construct a correlated event (the correlated events being the trigger
operation output set of events with the current event first).
If a trigger is not the last operation of a correlation rule (that is, it is followed by a flow

operator), then the output set of a trigger is used as the input set to other operations (through the
flow operator).
The discriminator (meta-tag list) is a comma-delimited list of meta-tags. A trigger operation

keeps different counts for each distinct combination of the discriminator meta-tags.

4.4 Rule Operations

Rule operations work on subrules that have been combined into a compound rule. They include:
Gate

 Sequence

4.4.1 Gate Operation

The gate operation is used to create a composite rule which is used in identifying complex situations
from the occurrence of simple situations.
The composite rule is made up of one or more nested subrules and can be configured to fire if some,
any or all of the subrules fire within a specified time window. The subrules can be a simple rule or
another composite rule. For more information on Composite Rule, see "Correlation Tab" in
6.1 User Guide.
The syntax for gate is:
Gate(<subrule 1 rulelg>, <subrule 2 rulelg>...<subrule n ruleLg>,
<evaluation period>, discriminator(<list of tags>))
Where
46 Sentinel 6.1 Reference Guide
If no letter is specified, seconds are assumed.
Sentinel
<mode>,