Linking segmentation rules to correlation rules
Links between a segmentation rule and correlation rules are created separately for each tenant. They are displayed in the Settings → Alerts → Segmentation section of the KUMA web interface in the table with the following columns:
- Tenant—the name of the tenant that owns the segmentation rules.
- Updated—date and time of the last update of the segmentation rules.
- Disabled—this column displays a label if the segmentation rules are turned off.
To link an alert segmentation rule to the correlation rules:
- In the KUMA web interface, open the Settings → Alerts → Segmentation section.
- Select the tenant for which you would like to create a segmentation rule:
- If the tenant already has segmentation rules, select it in the table.
- If the tenant has no segmentation rules, click Add settings for a new tenant and select the relevant tenant from the Tenant drop-down list.
A table with the created links between segmentation and correlation rule is displayed.
- In the Segmentation rule links group of settings, click Add and specify the segmentation rule settings:
- Name (required)—specify the segmentation rule name in this field. Must contain 1 to 128 Unicode characters.
- Tenants and correlation rule (required)—in this drop-down list, select the tenant and its correlation rule to separate the events of this tenant into an individual alert. You can select several correlation rules.
- Segmentation rule (required)—in this group of settings, select a previously created segmentation rule that defines the segmentation conditions.
- Disabled—select this check box to disable the segmentation rule link.
- Click Save.
The segmentation rule is linked to the correlation rules. Correlation events created by the specified correlation rules are combined into a separate alert with the name defined in the segmentation rule.
To disable links between segmentation rules and correlation rules for a tenant:
- Open the Settings → Alerts section of the KUMA web interface and select the tenant whose segmentation rules you want to disable.
- Select the Disabled check box.
- Click Save.
Links between segmentation rules and correlation rules are disabled for the selected tenant.