Rule Syntax Dialog

This topic describes the features of the Rule Syntax dialog. The Rule Syntax dialog displays the EPL syntax of conditions, statements, and debugging parameters, and provides a warning when the syntax is invalid.

Quick Look

To access this dialog:

  1. Go to netwitness_configureicon_24x21.png (Configure) > ESA Rules.
  2. In the Rule Library view, do one of the following:
    1. Click netwitness_ic-addlist_33x16.png and select Advanced EPL or Rule Builder.
    2. Double-click an existing rule.
    3. Select an existing rule and click netwitness_ic-edit.png in the Rule Library toolbar.
    4. In the row of an existing rule, select netwitness_ic-actns.png > Edit.
      The new or existing rule is displayed in a new tab, available to edit.
  3. Click Show Syntax at the bottom of the tab.

The following figure shows an example of the Rule Syntax dialog showing a valid rule.

netwitness_rulesyntaxdg_576x405.png

The following table describes the Rule Syntax dialog parameters.

Parameters Description
Rule is valid or Validation error in rule Indicates whether the rule syntax is valid or needs to be changed.
Rule Name Displays the name of the rule.
Text Displays the EPL syntax of conditions, statements, and debugging parameters if the rule is valid.