Skip to main content
Version: 6.1

Imperative Rules

An imperative rule describes an event sequence. The rule fires when events from the same group pass through every stage in the chain in the specified order.

Correlation​

On the Correlation tab, configure conditions that apply to the entire chain:

  1. In Pre-filter, enter an expression in the SML (RTC) dialect to broadly select events eligible for evaluation by the chain. Exact conditions for each step are configured separately in the stages
  2. Select Grouping Fields. The chain is tracked separately for each combination of these field values
  3. If necessary, enable Suppression Settings, and complete the Duration and Unit fields in the Suppression section that appears, as for a declarative rule. See Declarative Rules

Imperative Chain​

Build the stage sequence in Imperative Chain:

  1. Click Stage to add the next stage to the chain. Stages run strictly in the order in which they were added, and each stage type is shown as a label in its heading
  2. If necessary, select Reset Chain on Event Mismatch. If the next event in the group does not match the condition of the current stage, the chain is reset and starts again from the first stage
  3. Configure each stage. The available fields depend on the selected Type and are described in the next two sections

Event Stage​

An Event stage waits until the specified number of matching events has accumulated. To configure it:

  1. Enter a Name. Subsequent stages use this name to access the stage fields through the ctx() function. See Accessing Context
  2. In Type, select Event
  3. In Condition, enter an expression in the SML (RTC) dialect that an event must match to be counted by the stage
  4. Set Event Count Threshold to the number of matching events required to complete the stage
  5. Set the Time Window using the Duration and Unit fields. This is the interval during which the threshold events must accumulate
  6. If Event Count Threshold is greater than one, complete Event Aggregation Rules with metrics containing Source Field Name, Function, and Event Field. These metrics work in the same way as declarative rule firing format metrics. See Declarative Rules
  7. If necessary, select Save Source Events in Result Storage, and specify the Source Event Limit
  8. If necessary, enable Add to Context. The fields of the event counted by the stage then become available to subsequent stage conditions through the ctx() function

Absence Stage​

An Absence stage verifies that an expected event does not occur within the specified time. It has no threshold, metrics, or source event storage. To configure it:

  1. Enter a Name
  2. In Type, select Absence
  3. In Event That Cancels the Incident, enter the canceling event condition in the SAFL (RTC) dialect
  4. Set the Wait Time using the Duration and Unit fields

The stage completes if the canceling event does not arrive during the Wait Time. If it arrives in time, further progress along this branch of the chain stops.

Accessing Context​

The ctx(stage, field) function returns the value of a field saved by the stage whose Name is specified. The function works only for stages with Add to Context enabled. Fields from other stages cannot be accessed through ctx().