Skip to content
  • There are no suggestions because the search field is empty.

Rule Syntax Dialog

Rule Syntax DialogRule Syntax Dialog

This topic describes the features of the Rule Syntax dialog. The Rule Syntax dialog displays the EPL syntax of conditions, statements, and debugging parameters, and provides a warning when the syntax is invalid.

Quick LookQuick Look

To access this dialog:

  1. Go to netwitness_configureicon_24x21.png (Configure) > ESA Rules.
  2. In the Rule Library view, do one of the following:
    1. Click netwitness_ic-addlist_33x16.png and select Advanced EPL or Rule Builder.
    2. Double-click an existing rule.
    3. Select an existing rule and click netwitness_ic-edit.png in the Rule Library toolbar.
    4. In the row of an existing rule, select netwitness_ic-actns.png > Edit.
      The new or existing rule is displayed in a new tab, available to edit.
  3. Click Show Syntax at the bottom of the tab.

The following figure shows an example of the Rule Syntax dialog showing a valid rule.

netwitness_rulesyntaxdg_576x405.png

The following table describes the Rule Syntax dialog parameters.

  • Parameters: Rule is valid or Validation error in rule
  • Description: Indicates whether the rule syntax is valid or needs to be changed.

  • Parameters: Rule Name
  • Description: Displays the name of the rule.

  • Parameters: Text
  • Description: Displays the EPL syntax of conditions, statements, and debugging parameters if the rule is valid.