Creating an OR condition within the CRE

You can create a conditional OR test within the Custom Rules Engine (CRE), which gives you more options for defining your rules by using building blocks.

About this task

For each extra test that you add, it can be only an AND or AND NOT conditional test. To create an OR condition within the CRE you must place each separate set of conditions into a building block, and then create a new rule or building block that uses the when <selected_rule> matches any of the following rules rule.

Both building blocks are then loaded when the test is applied.

Procedure

  1. Click the Offenses tab.
  2. On the navigation menu, click Rules.
  3. From the Actions list, select one of the following options:
    • New Event Rule Select this option to configure a rule for events.
    • New Flow Rule Select this option to configure a rule for flows.
    • New Common Rule Select this option to configure a rule for events and flows.
    • New Offense Rule Select this option to configure a rule for offenses.
  4. Read the introductory text and then click Next.

    You are prompted to Choose the source from which you want this rule to generate.

    The default is the rule type that you selected on the Offenses tab.

  5. Optional: Select the rule type that you want to apply to the rule, and then click Next.
  6. From the Type to filter menu, select one of the following corresponding tests that is based on the option that you choose in step 3, and then click the (+) icon for the test.
    • when an event matches any|all of the following rules
    • when a flow matches any|all of the following rules
    • when a flow or an event matches any|all of the following rules
    • when the offense matches any of the following offense rules
    For example, if you select New Event Rule in step 3, select when an event matches any|all of the following rules.
  7. In the Rule pane, select one of the following corresponding tests that is based on the option that you choose in step 3, and then click rules.
    • and when an event matches any of the following rules
    • and when a flow matches any of the following rules
    • and when a flow or an event matches any of the following rules
    • and when the offense matches any of the following offense rules
    For example, if you select New Event Rule in step 3, select and when an event matches any of the following rules, and then click rules.
  8. From the Select the rule(s) to match and click 'Add' field, select multiple building blocks by holding down the Ctrl key and click Add +.

    If you select the offense rule, select building blocks from the Select an offense rule and click 'Add' field.

  9. Click Submit.