Creating and enabling event policies

To learn how to create some of these policies with examples, see the following topics:

• Example-Enriching-basic-event-attributes-and-sending-notifications
• Examples: Event policies for enrichment, correlation, notification, and suppression
• Example-Dynamically-enriching-events-from-an-external-file

To create an event policy

To create an event policy, perform the following steps:

1. Select Configuration > Event Policies and click Create.
2. Specify a unique name, optional description, and precedence number for the policy.

3. Create the event selection criteria based on which the policy is applied to the events. 

   Important

   • Values in the event selection criteria are case-sensitive. For example, Message Equals test and Message Equals TEST are considered as different values.
   • For event and blackout policies, we do not recommend using the less than (<), greater than (>), and the ampersand (&) characters in the selection criteria.

   • If you use special characters to specify slot values in the event selection criteria, make sure that you precede the special character with an escape character (\).

     For example, specify the value in the message slot as “Test\^Notification\^Policy" instead of “Test^Notification^Policy"

   • You can change the event class in the event selection criteria without removing the existing policy configurations only if slots in the existing policy configurations are available in the new class.

   The [expand] macro is a standalone macro and it cannot be used inline.
   The time frame for which the policy is always active.

4. Select one or more of the following policy types and configure them. The configured policy types are displayed in the policy evaluation order irrespective of the order in which they were configured. To know more about the policy evaluation order, see Event-policy-types-and-evaluation-order.
   You can set up multiple configurations for certain policy types. Each configuration is displayed as a policy card as shown in the following screenshot. Reorder the policy cards by dragging and dropping them to change the configuration execution order within a specific policy type. 
   
   
   

   Slots configured in the event policy settings

   Some of the event policies allow you to define slots while configuring the policy settings. The list of these slots is restricted to the event class selected in the the event selection criteria. If no class is selected in the event selection criteria, the base EVENT class slots are displayed for selection.  
5. Use the icons to edit or delete the configured policy types.
6. (Optional) Select Enable Policy.
   You can enable or disable the policy any time from the Event Policies page.
7. Save the policy.

To edit an event policy

On the Configuration > Event Policies page:

1. Do one of the following:
   
   • Select the policy and click Edit.
   • From the Actions menu of a policy, select Edit.
2. Edit the policy and save the changes.

To copy an event policy

On the Configuration > Event Policies page:

1. Click the action menu of the policy that you want to copy and select Copy. 
   The Create Event Policy page is displayed with the configurations of the copied policy. 
2. Modify the configurations according to your requirements to create a new policy quickly. 

To view the list of event policies

On the Configuration > Event Policies page, view the list of event policies.

By default, the policies are sorted by Name. To sort on a different column, click the column heading.

To enable or disable an event policy

On the Configuration > Event Policies page, do one of the following:

• Select the policy and click Enable or Disable.
• From the Actions menu of a policy, select Enable or Disable.
• Edit the policy and select or clear the Enable Policy check box.

To delete an event policy

On the Configuration > Event Policies page, do one of the following:

• Select one or more policies, click Delete, and click Yes.
• From the Actions menu of a policy, select Delete, and click Yes.