CORRELATION RULE FOR ARCSIGHT

1. Rule for Real time monitoring in company environment (means monitoring all rule triggered in one channel live ) 

Rule:-:

&

Type= Correlation

File path starts with /all rule/Real-time Rules/ 

° Continously evaluate time parameter