User guide

Reconnex Corporation
98
Release 7.0.0.4
3. Save Search.
4. Give the new rule a name.
Important: The characters * % @ + # ? , ' " cannot be used in name fields.
7. Using the drop-down Policy menu, attach the new rule to a policy.
In this case, you might file the new rule under a policy like Suspicious Activity.
7. Use the drop-down menu to set the Severity.
8. Specify the Inherit Policy State.
Selecting this option will tell the system whether or not you want to bind the rule to the policy by inheriting all
of its attributes — for example, its owner, inheritance state, or its publication or deployment status.
Note: When you add a rule to one of the standard policies, it will automatically inherit the state
of the policy to which you assign it. Even if you decide to disable it, once you modify the rule its
state and SAVE, it will default to the state of the parent policy.
9. Save.
10. To verify the new rule, go to Policies > Policies.
11. Click on the policy name.
12. Verify that your new rule is listed under the policy.
If you have disabled the Inherit Policy State, the Status column will show that it is
Inactive.until you resave the rule.
Tune a Rule
Tuning rules can help you search captured data with variations of a query until the rule routinely
returns the information you want.
Note: If you are creating or editing a rule under a standard (ERM) policy, you must first save
the rule with the Inherit Policy State Disabled. This will ensure the rule is not active even if it is
part of an active policy. For a user-defined rule, this is not necessary because the inherit policy
state is disabled by default.
To tune an existing rule or add a new one: