Policy Conditions

Applies to Product: USM Appliance™ LevelBlue OSSIM®

Set policy conditions to determine which elements of an incoming event USM Appliance will process. You set these conditions when you create a new policy or modify an existing one. You can set a number of conditions for the default policy group, but events generated in the server only use Event Types.

Policy Conditions with Source selected.

AlienVault OSSIM Limitations: USM Appliance includes more robust policies built into the environment, but you are allowed to customize and build your own rules based on your needs in LevelBlue OSSIM.