Local variables in selector

To use a local variable in a selector:

1. Add a local variable to the rule.
2. In the Correlation rules window, go to the General tab and add the created local variable to the Identical fields section. Prefix the local variable name with a "$" character.
3. In Correlation rules window, go to the Selectors tab, select an existing filter or create a new filter and click Add condition.
4. Select the event field as the operand.
5. Select the local variable as the event field value and prefix the variable name with a "$" character.
6. Specify the remaining filter settings.
7. Click Save.

For an example of using local variables, refer to the rule provided with KUMA: R403_Access to malicious resources from a host with disabled protection or an out-of-date anti-virus database.

Page top