onDetection element

The <onDetection> element is valid only for the duplicate, filter, sequence, and threshold rules. It specifies the action or set of actions to take when the rule pattern is detected.

Details

Table 1 describes how the rule pattern is detected for each rule type where an <onDetection> action is valid.
Table 1. How a rule pattern is detected based on the rule type
Rule type How the rule pattern is detected
duplicate This rule pattern is detected when the first event that meets the event selection criteria is received.
filter This rule pattern is detected when any event that meets the event selection criteria is received.
sequence This rule pattern is detected when a sequence of events that meet the event selection criteria are received in the appropriate order and within the time window.
threshold This rule pattern is detected when events that meet the event selection criteria are received within the time window and the threshold is met.

Attributes

<onDetection> has no attributes.

Contained within

<onDetection> is contained within the following elements:

Contains

<onDetection> contains the following element:

Table 2. Elements contained within the <onDetection> element
Element Required or optional?
<action> Optional. 0 or more occurrences are allowed.