0 Replies Latest reply on Oct 31, 2014 10:03 AM by pfabrizi

    Correlation based on Firing of another Correlation or Event

    pfabrizi

      I need to create  correlation that does the following within 10 mins of another event firing.

       

      How can this e done?

       

       

      (Threat_Category  = av.detect,av.pup)


      Within 10 minutes of


      (Threat_Category  = hip.Files,nip.detect,hip.Program,hip.Registry,hip.Buffer_Overflow)

       

       

      Thank You!