Submit a ticketCall us

Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.

 

 

 

 

Home > Success Center > Log & Event Manager (LEM) > SolarWinds LEM Quick Start and Deployment Guide > Set up your deployment > Define rules and configuration alerts

Define rules and configuration alerts

Table of contents
No headers
Created by Caroline Juszczak, last modified by Caroline Juszczak on Aug 05, 2016

Views: 289 Votes: 0 Revisions: 3

You can define rules and configuration alerts that alert you when specific conditions occur in your network. Rules help you to detect operational and compliance issues in your corporate network, such as external breaches, insider abuse, and policy violations.

Each rule requires you to define three settings: 

  • Correlation: The number of events that occur within a selected amount of time and the amount of time allocated to responding to the events.
  • Correlation time: The volume of events that match the correlation conditions and the rolling time window to evaluate the correlation.
  • Action: The action that occurs when the rule is triggered.

To define rules and configuration alerts:

  1. In the Getting Started widget, click Define Rules and Configure Alerts.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0E0/030/lem_qsg_specify_conditions.png

  2. Select the check box next to the types of rules you want to enable, and then click Next.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0E0/030/lem_qsg_enable_rules2_430x232.png

  3. Complete the fields and selections to define the condition, correlation time, and action for each new rule, and then click Apply.
  4. In the console, click Build > Rules.
  5. In the Rules grid, locate a new rule, click File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0E0/030/Button-Gear_16x13.png and select Enable.

    A File:Success_Center/Reusable_content_-_InfoDev/LEM/LEMQuickStart/0E0/030/icon-checkmark_enabled.png displays next to the enabled rule.

  6. Complete step 5 for each additional rule.
  7. Click Activate Rules to active all modified and new rules.
 
Last modified
09:46, 5 Aug 2016

Tags

Classifications

Public