I am having some challenges (the nicest way to say it publicly) with ESA
and thought it was time to ask the guru's and experts here. I have
created a total of 2 successful rules (basic rules mind you).
device_type is "AV device type"/"network based m...
Is there a way to configure an email alert from ESA to have the rule
name in the email subject line instead of having multiple Notifications
configured accordingly? Maybe this is a "feature request", maybe this is
on the road map for "11.0".... eithe...
I'm a bit perplexed on this one. The last time recently I ran across
this same error, I figured a way around by taking out the value to which
I was trying to have in the rule. But.... I've constructed a scenario I
want to create a rule against and I'...
One interesting apsect of managing a Security Analytics instance I'm
sure most of you all have shared the pain of is Windows event source
management. And if any of you are like me, you have a level of
impatience that is monumental. I tend to let my i...
Recently I stumbled across the Log Stats tab on my decoders Stats page.
When I discovered this, I thought "This is great information, but how
can I REALLY make efficient use of this as I am working to put the final
nails in the coffin of Envision?" R...
Application_rule_A - Works flawlessly.Building additional queries based
off of "alert = Application_rule_A" has worked very
successfully.Application_rule_B - Works flawlessly.This was my attempt
to take a working query that provides solid data return...
It was an operator issue. I did take the scenic route on the solution.
Download 90 rules from RSA LiveCopy syntax from all into new Notepad++
Portable windows (data is still there after you shut it down.... nice
hidden feature)Find out in the meta re...
The brackets were just my attempt at a "variable of my choosing". (I
could have used threat_source = $threat_source_value).The real rule does
look something like what you said, but.... It's the action meta key that
it's barking about... and it's a ke...
