0 Replies Latest reply on Jul 5, 2017 10:14 AM by jcandiat

    Nitro's Events





      I have the following doubt: in the nitro I have correlation rules created by me and the girls, they have alarms configured to be triggered when the field "Event subtype" does not belong to a blocked or remove-fail. The issue is that I need to add another evaluation field to trigger alarms that correspond to the number of events. I need the additional mind to evaluate the amount of events they received from a correlated rule. If the child has more than 10 events, send the corresponding alert. Where can I set the number of events?