Kaspersky Unified Monitoring and Analysis Platform

Properties of variables

Local and global variables

The properties of global variables differ from the properties of local variables.

Global variables:

• Global variables are declared at the correlator level and are applied only within the scope of this correlator.
• The global variables of the correlator can be queried from all correlation rules that are specified in it.
• In standard correlation rules, the same global variable can take different values in each selector.
• It is not possible to transfer global variables between different correlators.

Local variables:

• Local variables are declared at the correlation rule level and are applied only within the limits of this rule.
• In standard correlation rules, the scope of a local variable consists of only the selector in which the variable was declared.
• Local variables can be declared in any type of correlation rule.
• Local variables cannot be transferred between rules or selectors.
• A local variable cannot be used as a global variable.

Variables used in various types of correlation rules

• In operational correlation rules, on the Actions tab, you can specify all variables available or declared in this rule.
• In standard correlation rules, on the Actions tab, you can provide only those variables specified in these rules on the General tab, in the Identical fields field.
• In simple correlation rules, on the Actions tab, you can provide only those variables specified in these rules on the General tab, in the Inherited Fields field.