Advance EPL rules for login during silent hour

[XueYQ]

Hi,

May I know whether we can put more than 1 Meta keys in the identifier?

example:

@RSAAlert(oneInSeconds=0, identifiers={"user_dst","host_src","event_time"})
@Name ("Privilege users {user_dst} login to {host_src} at {event_time}")

[NaushadKasu1 · Accepted solution]

Yes, you can use multiple meta keys in the identifier which will form a unique grouping.

UPCOMING OOO: Nov 29 – Dec 9, Jan 13 – Jan 20 (2020)

Naushad Kasu

Senior Practice Consultant | RSA

m: 612.772.5843

naushad.kasu@rsa.com<mailto:naushad.kasu@rsa.com>

I Love My Job