Cascading multiple triggers


Usually, it is not necessary to have one trigger rely on the state of another trigger. However, it might be the case that you want to capture a message only after Pattern A, occurs, then Pattern B occurs.

Although no explicit Match Trigger State field occurs on the Trigger configuration screen, you can still make a trigger dependent on one or more triggers through the use of global variables in match expressions. You can define a trigger, for instance PattA. Then, you define a second trigger, for instance, PattB. As part of the Set Expression value of the second trigger, you specify ($patta eq set), that ensures the PattB trigger is set only if the PattA trigger is set first.

Using this technique, deep context can be established, where various messages must occur in a specific sequence before a particular thread is updated with a message, or a particular action is executed. Experience shows that providing careful naming conventions to triggers makes this activity much easier to analyze and keep track of. Otherwise, trigger associations can quickly become complex and difficult to understand, especially for analysts trying to understand the trigger rules created by some other user.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC AMI Command Center for Security 6.0