Question & Answer
Question
Why is the Add Anomaly Rule option greyed out in the Log Activity section?
Answer
The Add Anomaly Rule option in greyed out in the figure above. This is because Anomaly Rules require a Saved Search that defines the anomaly before the rule can be created.
Once a Saved Search has been defined the Add Anomaly Rule button will not be greyed out. To Create an Anomaly Rule.
- Create a Search or use a predefined Search from Saved Searches.
- If the search is not saved click Save Criteria and add to your list of Searches.
- Re-run the Search.
- From the Menu Bar click Rules > Add Anomaly Rule. The Rule Wizard will open.
- Click Next and add Your Rule Response.
- Click Finish.
Your Anomaly Rule is now complete.
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GncCAAS","label":"QRadar->Rules"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.1;7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
02 April 2020
UID
swg21691532