It would be nice to have the ability to run correlation rule againt history data and let the rule fire alerts.
Now it is only possible to test the rule, but not to have the rules run agains all the historic data.
Running on the stored data will provide more information about interesting data defined in a correlation rule in history.
by: Torsten F. | over a year ago | Other
Comments
Thank you for submitting this. We may have more questions for you about this in the near future.