Skip to Content

Correlation Macro function defined

The term Macro, when applied to software systems, refers to a single short keyword called the macro name that is used to represent a longer phrase called the macro value. During execution (or just prior to execution) each macro name is replaced by its macro value.

BMC Defender Server employs a straightforward macro facility, where macro names all take the form @@macro_name@@. The macro names are case-insensitive, can contain alphanumeric characters and underscores, but cannot contain spaces. Each macro name on the system must be unique, and macros cannot be nested.

Macro values, associated with each macro name, do not follow any particular conventions. The values can be any text string or data and are unconstrained except for a length of 500 characters or less. The value of the macro can be a single word, a phrase, or a full or partial match expression that implements all the rules and conventions presented in preceding sections.

Warning

Notes

  • The double at signs, used to distinguish macro names, make it highly unlikely that any text string matches the macro name; hence macros can almost always be used without any special regard or consideration for being confused with message content.
  • BMC Defender Server also employs macros as part of its Sigma Framework that permits web pages to be served containing macro values. These macros operate in a fashion almost identical to the macros described here, but have a different purpose and should not be confused with the correlation macros discussed in this section.

You can configure Macros on the Correlation > Config > Macros screen that allows you to add, modify, and delete macro definitions. A set of highly useful macros comes with the BMC Defender Server system and is documented in the following section.

The Expression Evaluation tool, discussed at the end of the first section, automatically expands macros and can be used to test macro values. Likewise, clicking the Audit link at the bottom of Threads, Triggers,and Actions screens shows the match expression with macro values substituted for any macro name.

Related topic

Using-correlation-macros

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC AMI Command Center for Security 6.2