Example event policies for enrichment, correlation, notification, and suppression

This topic provides example use cases that can help you configure enrichment, correlation, notification, and suppression policies. It also helps you to understand how you can combine various actions to build a policy workflow while creating or editing event policies. The examples take you through the steps involved in building the workflow and how the final workflow will look. To understand the basics about building a policy workflow, see Building-a-policy-workflow-for-advanced-and-time-based-enrichment.

To get a quick understanding about the various policy elements, see Elements-of-advanced-and-time-based-enrichment-policies.

Note that the event selection criteria specified before building the policy workflow is the first filter used for processing incoming (or new) events. Actions added in the policy workflow define conditions to process incoming events. However, some actions can be used to define conditions related to existing (or old) events. For more information about actions, see Actions for advanced enrichment.