Running a Rule Context Report

ESM generates a correlation event when a rule finds matching base events and triggers an action.

Purpose:

To generate a report containing the selected correlation event and associated base events that caused the rule to trigger.

Procedure:

1. In a grid view, select a correlation event marked with a Flash icon ().

2. Right-click it and select Report > Rule Context Report.

3. In the Report Parameters popup, enter the time, in minutes, before and after this event's occurrence and click OK.

4. You can choose to Open or Save the report file.

   A report showing the correlation event and the events that triggered the rule appears.