Writing Connector Policy › Policy Operations

Policy Operations

Connector policy consists of operations that provide processing and transformation instructions for events retrieved from a specific domain manager. You can write connector policy using the following operations in the connector policy file for any event (CI, relationship, or alert) in a domain manager:

• Classify
• Parse
• Enrich
• Normalize
• Format
• Evaluate
• Filter
• Write

Note: All policies must use valid USM types, properties, and enumerated values defined in the USM schema documentation.

Leverage global policy in outbound from connector policy to automate common operation (such as Write) by writing the initial element in the file as follows:

<Catalog version='1.0' globalextends='GLOBAL!'>

For more information, see Global Policy.