Are EPS rates calculated before, or after, policy filter rules?
Let's say I have a data source that's going crazy. The ESM keeps reporting that the EPS rate has been exceeded. I have our tech team investigating the source of the events. In the meantime, I create a filter with a PCRE and do NOT have the events sent to the parser.