Table of Contents
Advertisement
3.5.1 Starting or Stopping Correlation Engine
To Start or to Stop a Correlation Engine:
1 Open the Correlation Engine Manager window.
2 Highlight and right-click a Correlation Engine and select Start or Stop Engine.
3.5.2 Renaming Correlation Engine
A Sentinel system can have one or more Correlation Engines. You can rename the engines if
desired.
To Rename a Correlation Engine:
1 Open the Correlation Engine Manager window.
2 Right-click the Correlation Engine and select Rename Engine.
3 Modify the name of the Engine and click OK.
3.6 Correlation Actions
The Action Manager allows you to configure repeatable Actions. There are several different types of
Actions that can be configured and then associated with a correlation rule deployment:
Configure a Correlated Event
Add to Dynamic List
Remove from Dynamic List
Execute a Command
Send an Email
Create an Incident
Any Imported JavaScript Action Plugin that is marked by the plugin developer as requiring a
Correlated Event as input
NOTE: Although all of these actions can be used in correlation rule deployments, only the
JavaScript Actions can be used in other areas of the Sentinel Control Center. For more information,
see
Chapter 16, "Actions and Integrator," on page
Actions associated with a Correlation Rule are executed when the deployed correlation rule fires
(with the frequency of their execution determined by settings on the Update Criteria window of the
Correlation Rule Wizard).
86
Sentinel 6.1 User Guide
365.
Advertisement
Table of Contents
