Filter or Search for Rules

This topic shows analysts how to specify the type of rules that display in the Rule Library.

Prerequisites

Make sure that you understand the Rule Library view components. For more information, see Rule Library Panel.

Filter Rules

  1. Go to netwitness_configureicon_24x21.png (Configure) > ESA Rules.
    The Rules tab is displayed by default.
  2. In the Rule Library panel toolbar, click netwitness_ic-filt_35x23.png and select the severity and type of rules that you would like to appear in the Rule Library list. The following figure shows the Filter drop-down list.
    netwitness_rulfiltlst_288x288.png
    The selected rule types appear in the list.

Search for Rules

  1. Go to netwitness_configureicon_24x21.png (Configure) > ESA Rules.
    The Rules tab is displayed by default.
  2. In the Rule Library panel toolbar, type a rule name in the Filter field.
    The Rule Library panel lists the rules that match the names entered in the Filter field.