Correlation Engine Is Stopped; Correlation Rule; B.9.5 Correlation Rule; Correlation Rule Configuration - Novell SENTINEL 6.1 SP2 - 02-2010 User Manual

B.9.4 Correlation Engine is Stopped
This event is sent out when the engine changes state from running to stopped.
Table B-75
Tag
Severity
Event Name
Resource
SubResource
Message

B.9.5 Correlation Rule

Table B-76
Tag
Severity
Event Name
Resource
SubResource
Message
B.9.6 Correlation Rule Configuration
Table B-77
Tag
Severity
Event Name
Resource
SubResource
Message
494 Sentinel 6.1 User Guide
Correlation Engine - Correlation Engine is Stopped
Value
1
EngineStopped
CorrelationEngine
CorrelationEngine
Correlation Engine has stopped processing events.
Correlation Engine - Correlation Rule
Value
New/Update/Remove
Correlation
CorrRule
Rule Name: <name> Type: <type> Rule Id: <ID>
Correlation Engine - Correlation Rule Configuration
Value
New/Update/Remove
Correlation
CorrRuleConfig
Correlation Rule Config ID: <ID> Rule Definition ID: {1} Name: <name> Active: {3}