Creating a Session List Rule

Make sure you have created a session list for this procedure.

Purpose: To create a rule that writes new sessions, or re-sends start times, into an existing session list.

Where: Navigator > Resources > Rules

Procedure:

1. Right-click a rule group and select New Rule > Standard Rule. The Rules Editor displays in the Inspect/Edit panel.

2. At the General tab, enter the following values:

   Rule Settings for Session Lists

   In this field...	...enter this
   Name	Enter a name in the Rule Name text field. The Rule Name should be as descriptive as possible. It is stored in the Event Name data field and appears in the Event Name column of the grid view. The Rule Name text field is required and restricted to 25 characters.
   Rule Type	Keep the selection, Standard Rule. Using a standard rule allows multiple event conditions, aggregations, and triggers. However, if you want to keep the rule simple, consider a Lightweight Rule, which is limited to acting on lists. See Rule Types for more details.
   Common: External ID, Alias	If this rule is referenced by an external system, such as a vulnerability scanner, enter the pertinent external ID information here. If not, leave these fields blank.
   Description	Enter a description in the Description text field. The description should be meaningful and detailed. For example, "This rule creates an entry to the DHCP session list when a new DHCP session starts."
   Assign: Owner, Notification Groups	Optional: Specify an owner for this resource. To notify other users automatically when this rule is changed, select existing users and notification groups from the drop-down menu.

3. On the Conditions tab, enter the conditions that indicate a session start and click Apply.

4. On the Aggregation tab, specify the event fields from the session list that you want to have displayed in the event grid when the rule is triggered by the session conditions specified in the Conditions tab. Aggregate all items you specified in your session list so that those values are populated when the event occurs.

5. On the Actions tab, set the trigger and the action you wish the rule to take when the conditions are met:

1. Select the trigger you want to apply to this rule and make sure it is activated.

   On First Event is the default trigger. This determines which occurrence of the “session start” conditions will trigger the action to write the event to the session list as the start of a session. See Threshold Triggering Options for details on the available triggers.

   Tip: You can use references to Velocity Templates as parameters for rule actions to derive values from event fields and variables. (See Velocity Templates.)

2. While the trigger is selected, click Add to add an action. Select Session List | Add to Session List.

3. In the Add Action dialog box at the Session List drop-down menu, navigate to the session list you created earlier. The parameters you set for the session list are displayed in the Session Field Mapping area.

4. In the Session Field Mapping area at the Start Time field, select which event time stamp you want to use to record as the official start time.

   Start Time	Description
   End Time	The time the event ended.
   Manager Receipt Time	The time the event arrived at the Manager.

5. For the remaining fields you specified in your session list that have multiple choices, select which value you wish to use for your session list and click OK. You can find a description of the data fields, see Data Fields.

6. Optional: To add information in the Notes tab, refer to Using Notes.

7. Click OK. The relevant events matching this rule will populate the session list.