ESA Rule Creation

[Sachin]

ESA question :

I have 2 events coming in  - 2 events are from different device type with different contents. both arriving within say 5-10 Minutes.
I need to create a rule that matches 5-10 minutes previous event from one device type with the real time event coming from other device type.

Any suggestions will be  helpful, Thanks in advance!

[AhmadJabr1]

you can set the time in the rule for 15 min or more, and then set the first rule and use "followed by" the second rule,

but this could affect the Memory on the ESA server

[lukaszczerwonka]

You can try with 'create window' in Advanced EPL

https://community.rsa.com/t5/rsa-netwitness-platform-online/alerting-example-advanced-epl-rules/ta-p/568964