Hide this message
Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.
In Rule Creation, the Actions box defines which action response the manager executes when the correlation events specified by the rule occurs. You can assign more than one action to a rule. For example, you can shut down an agent and then notify your system administrator of the event through email.
The Actions box fields indicate where the action is performed, what the action does, and who receives the action. For example, if you want a rule to disable a user, you can select Disable Domain User Account. To apply the action, specify which account you want to disable and where you want to disable it (that is, which agent).
When configuring an action, you can assign constants that define fixed parameters for a rule or alert fields from the alerts in the Correlations box. Fields determine the rule parameters when some degree of flexibility is required. Constants and fields are useful, but fields provide actions with a great deal of flexibility.
For example, if you have two network users named Bob and Jane, you can disable Bob???s user account and assign a constant to the rule that explicitly represents Bob???s account. However, this limits the rule to Bob's account.
If you assign a field to the rule, the rule can be interpreted as follows: When user activity meets the conditions in the Correlations box to prompt the Disable Domain User Account action, use the
UserDisable.SourceAccount field in the alert to determine which user account to disable.
If Bob triggered the rule, the manager disables Bob???s account. But if Jane also triggers the rule, the manager can disable her account as well.
Select and drag an action to the Actions box.
The top left of the Actions box shows the name the action that will execute. In most cases, the Actions form prompts you for specific parameters about the computer, IP address, port, alert, user, and so on that receives the action.
(Optional) Select and drag a constant from the Constants lists to the parameter box in the Actions form. Typically, you will select a text constant.