How to enable a Correlation Alert that was disabled in the Control Center. (NETIQKB72464)

The purpose of this article is to explain how to re-enable Alerting on a Correlation rule, where the rule was suspended from the Control Center.

To enable Alerting on a Correlation rule that was disabled through the Control Center, see the following steps:

1. Open the Security Manager Development Console.
   
   
2. Find the Correlation Alert Rule that was suspended.
   
   
3. Right click on the rule in question and select Edit. This will launch the Correlation Wizard for this rule.
   
   
4. Inside the Correlation Wizard, click on the Response link on the left side of the pane.
   
   
5. On the Reponses tab, change the Alert to Generate option from : " None: Do not generate an alert." to one of the Generate alert options.
   
   
6. Click Apply and then click ok.
   
   
7. In the Development Console, right click on Configuration and then select Force Configuration Changes now.

The work flow for suspending an Event Processing Rule that Alerts is different for a Correlation Alert Rule.

Formerly known as NETIQKB72464

When normal Alert rules are suspended in the Control Center, the Event Processing Rule that generated the Alert is disabled.