no meta key for correlated alert

[Anonymous]

i have made a correlation rule for 5 or more than 5 time  failed logon on a single ip or single destination but when alert goes hit then we are not able to see meta key, in event viewer it showing 0 size.

refer attached screen shot.

[Anonymous]

You may want to create a App Rule for the event, and have that as input to the CEP/ESA, that way the event would be available as 'alert' or 'alert ID' in investigator.

[Anonymous]

Hi Vivek thanks, but we dont have the ESA device we have to make correlation rule on decoder. or any other option we have to get alert when 5 or more than 5 failed logon attampt on single destination user or single device.ip?

[Anonymous]

I think we can’t have correlation on discrete events without ESA or CEP.

The BER option in decoder has no time-bounding, and also it can’t alert out to email.

Kind Regards,

[Anonymous]

but customer is demanding for the alert when 5 or more than 5 failed logon attempt in 5 min on any destination user or single destination IP or device ip, as per him single failed logon alert or mail doesnot make any sense, it can be happen by mistake.

so, he needs time bound alert

[Anonymous]

Then you need ESA (10.3) or CEP (10.2).

See sadocs.emc.com for details.

Kind Regards,

[LeeKirkpatrick · Accepted solution]

Try taking the "corr.drill" value shown in your screenshot "Correlation alert.bmp" and use this as a custom drill to see the events that caused this Correlation Rule to fire.