3 Replies Latest reply on Aug 17, 2016 9:56 AM by xded

    Rule correlation Not match rule

    layer0

      Hello

       

      I have a situation, I want to create a rule that shows me when a particular event didn't trigger in a perior of time. So for example if i want to watch for the event with signature ID 363-2411, over a period of 2 minutes, i think that the rule must be like this, but it doesn't trigger. For example:

       

      Captura.PNG

       

      And in the logical operator.

       

      Captura2.PNG

       

      I don't see any event with this rule, why?

       

      Thanks