SMRTC

Overview

SMRTC correlates security events before they reach Search Anywhere Framework. A rule is evaluated against every incoming event rather than against data that has already been stored.

This distinguishes SMRTC from retrospective Job Scheduler jobs. A scheduled search job runs according to a schedule and searches for matches by querying an index containing events that have already been indexed. SMRTC, by contrast, evaluates rule conditions as soon as each event arrives.

Installation

2 items

Settings and Management

5 items

Streaming Jobst

3 items

Active Lists

SMRTC active lists: list management, record parameters, replication and node placement, automatic population from the event stream, and use in rules.

SAFL (RTC)

Syntax of the SAFL (RTC) dialect.