1 Reply Latest reply on Apr 4, 2017 12:28 AM by abanaru

    Correlation rule with filters

    mehmetemin

      Hi,

      I want to ask you about correlation rule that you can see the ss at the below.

       

      I've written the rule Signature ID IN (43-*** -an account has logged on)

                                     Time of day is NOT IN  between 7 to 19

                                     Day of week is IN Monday to Friday (work days)

       

      Is this rule true or should i divide the filters and use AND logic that signature id is filter 1, time of day is filter 2, day of week is filter3 ?

      Second question should i group by destination user?

      Thanks.