Edit an ESA Rule

This topic provides instructions to edit an Event Stream Analysis (ESA) rule. When you edit a rule, ESA applies the updated criteria going forward. No changes are made to previously generated alerts.

To edit an ESA Rule

  1. Go to Configure.png(CONFIGURE) > Policies.

  2. In the policies panel, click Content.

  3. In the left panel, click Content Library.

    The available rules are displayed.

  4. Click Event Stream Analysis Rule.

  5. In the ESA rule panel, select the rule that needs to be edited.

    The overview panel opens, showing the Edit Rule tab on top.

  6. Click the Edit Rule tab.

    12.3ESARuleMan3.png

    It navigates to ESA Rules > Rules view.

    For more information on editing an ESA rule, see Edit, Duplicate or Delete a Rule.