ESA Rules.

[ezramanda]

Hello. Our config is only Concentrator and Packet decoder. We do not have ESA live account. Now I would like to know how we could create custom alerts using rule builder. I tried this way > Alerts > Configure > Rule library >  Rulebuilder > Conditions >

When I am trying to use metakeys it is not accepting metakeys. I am using correct syntax (ie tcp_dstport). My role permission is set to manage rules under my role by my administrator. Can any one help me with this please?

[jeffshurtliff · Accepted solution]

Hi Ezra,

If you do not have an ESA appliance, then you will want to create alerts using application rules on the Decoder and/or Reporting Engine alerts.

(The links above point to the documentation for each of those.)

Thanks,

Jeff