Administration Guide › Action Alerts › Customizing Queries for Action Alerts › Identify the Simple Filter for Severe Events

Identify the Simple Filter for Severe Events

Events vary in severity from informational to fatal. CA assigns a value between 2 and 7 to indicate the severity of events based on the CEG model of Category, Class, Action and Result. Severity 7 is assigned to system shutdown events. Severity 6 is assigned to events with high security implications or that need immediate attention.

If you plan to create custom queries or to customize predefined queries for use in alerts, it is a good idea to examine the CEG model definitions of severe event types. The model definition is the basis for simple filters. That is, you can create queries that retrieve events based on your specification of their event category, event class, event action, and event result.

To identify the simple filter for severe events

1. Click the Help link.
2. Expand Common Event Grammar, and select Security Level Assignment.
3. Copy the table to a spreadsheet and sort by Security Level from highest to lowest.

   The resulting table lists event types beginning with the most severe based on CA Security Level assignment.

   An example follows. Your results will reflect the current CEG definitions.