Table of Contents
Advertisement
Clicking Apply saves the changes you made for the currently selected event column in a
temporary buffer. If you don't click Apply, the changes you made to the previously selected
event column are lost when you select a different event column. Changes won't be saved to the
server until you click Save.
8 If you want to edit the event mapping of another Event column, repeat
Remember to click Apply after editing the Event Mapping of each Event column.
9 Click Save.
Clicking Save saves your changes to the server. The save function saves all changes stored in
the temporary buffer.
10.8.2 Renaming Tags
The Event Configuration window also allows you to assign names to existing event tag labels. For
example, you can rename the label for event tag Ct2 to City. Doing this results in the event tag that
formerly appeared in the Sentinel Control Center as Ct2 to now appear as City. Event tags appear in
the Sentinel Control Center in places such as filters, correlation rules, and Active Views.
Renaming tags does not change the name of the variable in Collector scripts or in internal Sentinel
representations of the tag. For example, even if the event tag labeled Ct2 is renamed to City, the
variable that must be used in a Collector script to reference this meta tag is still s_CT2. Any
references to this variable in correlation or filters still work, even if they were originally written
using Ct2.
Below is a before and after illustration of this feature in an Active View.
Active View Window: Before
Figure 10-19
Active View Window: After
Figure 10-20
To rename an event column:
1 Click Event Configuration in the navigation pane or click the Event Configuration button.
The original Event Column name displays above the Label field. In addition, the description of
the event column is provided.
2 Select an event column entry.
3 Specify a new value for your Event Column in the Label field.
Step 2
through
Step
7.
Administration 253
Advertisement
Table of Contents
