Understanding the Logic for Defining Rule Conditions
An alert or Linux prevent rule comprises conditions that define the criteria/logic for triggering an alert.
This topic describes the logic behind the rule conditions and the expected behavior of the system when defining a detection policy. You should read this topic before you attempt to create or edit alert or Linux prevent rules.
About Conditions
Each condition is evaluated as part of the rule. Each condition comprises:
Field (that is being tested). For example: "Server name".
Operator (for example, "is, is not, contains, ...").
- Note: Depending on the mode (see Values Mode versus List mode below), the operator for the condition may differ. For example, "contains" in "Values mode" would be "contains value from the list" in List mode.
Value(s) (to test against). For example: "SRV, DB, LAP".
Values Mode versus List Mode
When defining values by which to evaluate a condition of an alert rule, you can enter multiple values separated by commas either directly or by clicking the […] icon to open a popup in which you can enter the value. When Lists are supported (see Understanding Lists in ObserveIT), you can choose to select a predefined List instead of entering a set of values. By hovering over the values field, two icons appear that enable you to switch between the modes:
|
Values mode |
|
|
List mode |
|
When List mode is selected, a drop-down list shows all the predefined Public and Private lists that are authorized for this Console User that match the condition. You can select the required List or click the Edit List hyperlink to edit the properties of a selected List. Only General type lists are supported.
Rules for Configuring Alert Conditions
For each of the "Who-Did What-....." sections, you can configure a number of alert conditions.
To define an additional condition, click the 
icon.
To delete a condition, click the adjacent 
icon.
You can sort the order of your conditions by clicking the 
icon.
The "Who-Did What-....." sections always relate to each other with the "AND" logic. For example:
|
|
|
|
|
|
|
|
|
|
|
|
|
You can choose whether all conditions within a "Who-Did What-....." section must match (by using the "AND" logic), or whether any of the conditions may apply (by using the "OR" logic). You cannot configure "AND and "OR" conditions within the same criteria section. To switch between "AND" and "OR", simply click on the text.
A negative condition, for example, "Window title does not contain x, y, z", means that the Window title does not contain "x", nor "y", nor "z".
The system should trigger a new alert if any of the matched conditions are different from previously triggered alerts. For example, when the condition "User ran application Regedit, SQL Manager, or CMD" is defined, an alert is triggered if the user runs "Regedit" or "CMD".