Understanding Event and Alert Management › Concepts › Events › Event Policies

Event Policies

An event policy is a combination of event search patterns and an action to perform when the patterns match. You can perform the following event policy actions:

• Save them for an on demand view of events that match the search patterns.
• Deploy them to evaluate incoming events that are dynamically based on the search criteria and perform the specified action in response to matches.

Event policies let you manage when and how events become alerts in CA SOI. CA SOI provides the following action types:

• Correlation to associate related events that are based on any criteria
• Filtering to eliminate extraneous events and subsequently lower alert volume
• Creating new events as a result of event policies to consolidate multiple conditions into one actionable condition
• Enriching events to add vital information from outside sources
• Normalization to map raw events to USM alert properties

Note: For more information and procedures about event policies, see the Event and Alert Management Best Practices Guide.