Rules and Alarm Configuration
What the exam tests
This domain tests the link between detection logic and actionable alarms: AI Engine rules, Alarm Rules, Alarm Templates, notifications, and SmartResponse.
Core rules
- Alarm Rules match conditions such as AI Engine rule, log source, classification, entity, or severity; they create Alarms.
- Alarm Templates define alarm fields, severity, notification, and SmartResponse; the template shapes the final alarm.
- Alarm Rule order matters: evaluate priority so specific rules are not shadowed by broad rules.
- Notifications can be email, SNMP, syslog, or SmartResponse; test them with a controlled trigger.
- Suppression and maintenance mode reduce noise, but document them so they are not forgotten.
- Copy system rules before editing; preserve vendor content for upgrades.
Worked example
Requirement: alarm when 10 failed logins occur for one user in 5 minutes. Build a threshold AI Engine rule grouped by user with a 5-minute window. Create an Alarm Rule that matches that AI Engine rule and the relevant entity. Attach an Alarm Template with severity High and email notification. Test with synthetic events, then verify the alarm, notification, and drill-down. If the alarm fires but severity is wrong, inspect the template, not the AI Engine rule.
Traps
- Editing a system rule in place and losing it on upgrade.
- Creating an Alarm Rule without a matching Alarm Template.
- Forgetting that broad rules earlier in order can capture events first.
- Testing only the AI Engine rule and not the full alarm path.
- Leaving test notifications enabled in production.