Could someone help me with custom rules. I've created a simple cutom rule like Logon, where I take Signature ID. Without Signature ID rules working just fine. How can I create a rule with Signature ID? ESM and ACE 11.1.1 verison. In-pack rules working. Custom Rules by Signature ID worked on ESM combo-box 10.3. Perhaps, this is a some feature in new version?
Solved! Go to Solution.
I'm trying to create custom correlation rules and define them with signature ID, but they are not wotking with such configuration. On the combo box 10.3 the were firing with signature id's but on ACE 11.1.1 they doesn't. On the screenshot i took signature id which means an account was successfully logged on, I'm trying to understand why rules not working. Event receiver is working, in packs rules working too.
@GlebSmagin i'm shocked!!!
how could it be that the version doesn't support such a basic field as
"Signature ID" it's the basic of the basic......
I'm Interested of hearing from the McAfee guys in this forum answers...