About Valid and Invalid Resources

Valid resources appear in the Navigator with their associated icons. For example, the Navigator displays a valid filter like this:.

A valid resource is fully available to other resources that reference it. The resource can participate in the event flow, trends, reports, data monitors, channels, filters, rules, and so forth.

A resource can "break" or become "invalid" either because it is constructed improperly. For example, an active list schema does not match the underlying table. Changes to resources can also break other resources that have dependencies. For example, a filter referenced by a rule is no longer available. This happens when a resource being depended on is deleted, renamed, or moved in the Manager; or not retained during an upgrade, import, or export.

Invalid resources appear in the Navigator as broken or torn. For example, and the Navigator displays an invalid filter like this: .

An invalid resource includes an Invalid Reason field under on the Attributes tab of its editor, as described in.

An invalid resource cannot participate in the event flow or other resources in real time. For example, an invalid asset cannot participate in event asset resolution. Correlated events in which the source or target address points to the invalid asset are not generated. Similarly, an invalid rule does not trigger and generate correlation events.