cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 9
Report Inappropriate Content
Message 1 of 4

Correlation criterion - there was no event

Is it possible to create a correlation rule that will be triggered if, for example, event A appears, but event B should have appeared before it within a period of time?

3 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: Correlation criterion - there was no event

Yes, you can create a correlation rule logic & fine tine the logic by using the AND operator & 2 Match components.

In one match component, you can specify a filter for the Signature ID so that an event has to be captured using the Signature ID of Event B within the specified period of time using "Time of Day" filter. Here you can specify the Start time & End time.

In the other match component, you can specify filters for the Signature ID of Event A, followed by the Time of Day filter i.e after the time period when Event B was captured.

The AND operator will be used to combine these two match components.

Regards,

Prashanth B Pillai

McAfee Technical Support

Customer Success Group

Highlighted
Level 9
Report Inappropriate Content
Message 3 of 4

Re: Correlation criterion - there was no event

I will try it soon, thank you very much!

Highlighted
Level 9
Report Inappropriate Content
Message 4 of 4

Re: Correlation criterion - there was no event

Correlation LogicCorrelation Logic

And if I am interested, for example, that the event "Login" appeared, but one of the three events has not appeared within 3 hours before that.

Time of Day will not work in this case. It turns out that i need to configure Time Windows on the logical element AND?

Attached a screenshot of the rule, did I understand you correctly?
(The rule, by the way, does not work).
Thank you in advance!

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community