Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Example: Correlating Events Based on Receipt of Other Events Within a Specified Time Interval

 

In the following policy, a set of commands is issued and the output is logged and saved to a given location. The policy is executed if event3, event4, or event5 occurs within 60 seconds after event1 or event2 occurs. The pseudocode for the policy is as follows:

Specify two archive sites in the configuration. The device attempts to transfer to the first archive site in the list, moving to the next site only if the transfer fails.