How to enable a Correlation Alert that was disabled in the Control Center. (NETIQKB72464)

  • 7772464
  • 19-Jul-2010
  • 03-Apr-2012

Environment

Security Manager 6.x

Situation

The purpose of this article is to explain how to re-enable Alerting on a Correlation rule, where the rule was suspended from the Control Center.

Resolution

To enable Alerting on a Correlation rule that was disabled through the Control Center, see the following steps:

  1. Open the Security Manager Development Console.

  2. Find the Correlation Alert Rule that was suspended.

  3. Right click on the rule in question and select Edit. This will launch the Correlation Wizard for this rule.

  4. Inside the Correlation Wizard, click on the Response link on the left side of the pane.

  5. On the Reponses tab, change the Alert to Generate option from : " None: Do not generate an alert." to one of the Generate alert options.

  6. Click Apply and then click ok.

  7. In the Development Console, right click on Configuration and then select Force Configuration Changes now.

Cause

The work flow for suspending an Event Processing Rule that Alerts is different for a Correlation Alert Rule.

Additional Information

Formerly known as NETIQKB72464

When normal Alert rules are suspended in the Control Center, the Event Processing Rule that generated the Alert is disabled.