Viewing performance statistics for a correlation rule

Performance statistics in the group table

• Times Fired: The total number of times the rule ran since the rule became active.
• Draft comment: DEIRDRELAWTON
  BSM 69490
  Times Fired in Last Month: The last month time period is counted as 30 days instead of a calendar month. The total number of times that the rule is fired in the current 30 days. Time periods are calculated from the creation date of the group.
• Last Fired: The last date or time that the rule was fired.
• Last Occurrence I: The percentage of events that occurred from the group, in the last fired rule.
• Last Occurrence II: The percentage of events that occurred from the group in the second last fired rule.
• Last Occurrence III: The percentage of events that occurred from the group in the third last fired rule.

Performance statistics in the event table

• Occurrence: The number of times the event occurred, for all the times the rule fired.

Reset performance statistics

You can reset performance statistics to zero for a group in the Watched, Active, or Expired tabs. To reset performance statistics, right-click on the group name and from the menu select Reset performance statistics. A message displays indicating that the operation will reset statistics data for the selected correlation rule. The message also indicates that you will not be able to retrieve this data. Click Yes to continue with the operation or No to stop the operation. A success message displays after you select Yes.

Resetting performance statistics to zero for a group also causes the following columns to be cleared: Times Fired, Times Fired in Last Month, and Last Fired. Note that performance statistics are not collected for the Archived tab. When a rule is moved between states, the performance statistics are reset. Every time an action is triggered by the rule the performance statistics increase.