Hi everyone, We're currently facing an issue with an EPL rule in RSA
NetWitness that isn't triggering as expected. The rule is designed to
detect a specific sequence of events (Event ID 778 followed by Event ID
780), but the timer in the rule seems t...
Thanks for your suggestion! I tried implementing the .win.time(650 sec)
adjustment in the rule, but unfortunately, it's still not working as
expected. I received a validation error, and it seems that .win.time()
cannot be used after the pattern block...
