A collection rule is defined by the collection pattern. It collects a group of selected events within a time interval. It is a stateful rule.
The collection pattern is used to gather similar events over a period of time. The time period is indicated by a mandatory time window, as defined by the <timeWindow> element in the rule language.
With the collection pattern, the rule response runs when the time window is complete, as defined by the <onTimeWindowComplete> element.
It collects events that meet the criteria of a certain event selector during the time period. When the time period ends, it summarizes the collected events into a single event that contains the total count of events and characteristic information about the summarized events.