Environment
Security Manager 6.x
Situation
The purpose of this article is to explain how to re-enable Alerting on a Correlation rule, where the rule was suspended from the Control Center.
Resolution
To enable Alerting on a Correlation rule that was disabled through the Control Center, see the following steps:
- Open the Security Manager Development Console.
- Find the Correlation Alert Rule that was suspended.
- Right click on the rule in question and select Edit. This will launch the Correlation Wizard for this rule.
- Inside the Correlation Wizard, click on the Response link on the left side of the pane.
- On the Reponses tab, change the Alert to Generate option from : " None: Do not generate an alert." to one of the Generate alert options.
- Click Apply and then click ok.
- In the Development Console, right click on Configuration and then select Force Configuration Changes now.
Cause
The work flow for suspending an Event Processing Rule that Alerts is different for a Correlation Alert Rule.
Additional Information
Formerly known as NETIQKB72464
When normal Alert rules are suspended in the Control Center, the Event Processing Rule that generated the Alert is disabled.