Event policy types, evaluation order, and templates
This topic provides information about the event policy types, the order in which event policies are evaluated, and the out-of-the-box event policy templates.
Event policy types
The different event policy types are:
- Basic Enrichment: Processes events with refined slot values to make the events more meaningful.
- Suppression: Automatically drops new events matching the event selection criteria.
- Advanced Enrichment: Processes events with refined slot values based on advanced settings and the defined policy workflow.
- Dynamic Enrichment: An extension of advanced enrichment, this policy helps you enrich events with external data.
- Time Based: Processes events with refined slot values after a scheduled duration of time and based on the advanced settings and the defined policy workflow.
- Correlation: Correlates and combines multiple matching events into a single aggregated event.
- Notification: Notifies users via email or incidents generated for Proactive Service Integration (PSR) about an event occurrence so that actions can be taken.
Policy evaluation order for processing events
In general, events flow through phases based on certain built-in rules. Each phase represents a logical state of processing.
The event policy types and blackout policies are associated with a particular phase through which the event must flow. These policies process each incoming event one phase at a time, and evaluate each event based on the built-in rules.
Based on the built-in rules, policies are automatically run in the following evaluation order, irrespective of the order in which they were configured.
- Basic enrichment policy
- Blackout policy
- Suppression policy
- Advanced enrichment policy and dynamic enrichment policy (between the two policies, that which was configured first is evaluated first)
- Time-based enrichment policy
- Correlation policy
- Notification policy
The policy evaluation order supersedes the precedence number specified in the various types of policies. This means, even if you configure a separate event policy for each of the types with varying precedence numbers, the policy evaluation order is used to run the policies.
However, if you have multiple event policies of different types with varying precedence numbers, then policies of the same type are run based on the precedence number specified.
Example scenarios
Where to go from here
To create, edit, enable, disable, or delete an event policy, see Creating-and-enabling-event-policies.
To understand advanced, time-based, and dynamic enrichment policies, see Advanced-time-based-and-dynamic-enrichment-policies.
To understand correlation policies, see Correlating events.
To understand the out-of-the-box event classes and associated slots, see Event-classification-and-formatting.