Defining the "On Which Computer?" Conditions
In the On Which Computer? section of the Create Alert/Prevent Rule page, you can define (or edit) the specific or groups of computers/servers on which the suspicious activity occurred.
The On Which Computer? condition can be configured for both alert and prevent rules.
To define the "On Which Computer" conditions
-
Open the On Which Computer section by clicking
or the Edit
icon. 
-
To define the specific or groups of computers/servers on which the action occurred, select the required field, relevant operator, and specify value(s) for each condition that you want to define, as described in the following table.
When defining the values by which to evaluate the condition of an alert rule, you can enter multiple values separated by commas either directly or by clicking the […] icon to open a popup in which you can enter the value. When Lists are supported, you can choose to select a predefined List instead of entering a set of values. You can use Lists to define values for all of the following options. Note that the operator for the condition also depends on whether you are defining values or Lists; for example, "contains" in "Values mode" would be "contains value from the list" in List mode. For details, see Understanding the Logic for Defining Rule Conditions.
Options for Defining the "On Which Computer?" Conditions
|
Field |
Operator |
Example Values |
|---|---|---|
|
Computer domain\name |
|
LOCAL\DB, DomainA\FIN |
|
ObserveIT server group name |
|
Windows, GroupA, Unix |
|
Computer IP address |
|
10.1.100.100, 10.1.200.61 Note: When alert rules are based on IP address ranges, you can specify the IP address range using the CIDR notation format: aaa.bbb.ccc,ddd/N, where N in an integer between 0-32. You can click the link Check CIDR syntax to check if your format is permitted. |
|
OS name |
|
Windows 2016 R2, Ubuntu, Solaris 11 |
|
Agent version number |
|
5.6.9, 5.7.3 |
