Working with Event Policies and Actions › Event Policy with Actions › Event Policy Best Practices

Event Policy Best Practices

To decide which event action use in a policy, use the following guidelines:

• Use an isolated filter action when filtering events not associated with another action. If a create event action requires you to filter the original events, create a filter action that filters based on the same search criteria.
• Use a create event action when multiple events correlate to require a separate event message summarizing the correlated condition. If one or two properties in a single event require more or different information, use enrichment or normalization instead.
• Enrichment and normalization actions both let you modify event property values.

  Use enrichment in the following situations:

  • When an event requires extra information in a property available for enrichment. Most optional properties are available for use in enrichments. Required properties are not supported for enrichments in the user interface. The enrichment source can return an invalid required property value and can break the policy.
  • When an event requires extra information stored in some other external source. Only enrichments can extract information from external sources. Assign the enrichment information to one of the properties that the enrichment action supports.

  Use normalization in the following situations:

  • When a required event property requires new or more information. Any information that you enter in a normalization action overwrites the mapping for that property in the default policy. Normalization actions enforce valid values for enumerated properties and values for all required properties. You can then interact with these properties with less potential for error.
  • When events from a raw event source require more detailed normalization rules to become manageable alerts.

To ensure a valid policy action, use the following best practices:

• Run an event search before creating any non-filter policy, so that the search results are available in the Event Log table for previewing changes.
• Verify that search patterns are valid and provide expected results before creating policy based on them.
• Test all enrichment connection information before assigning enrichment values.
• Do not use the &, <, and ' characters on the Create New Event, Normalize Event, and Enrichment Policy pages.
• Read the Confirm page carefully before finalizing the policy to verify that all settings are correct.
• CA Catalyst connectors do not support database enrichments. Deploy database enrichments on the Mid-tier connector to enrichment CA Catalyst connectors with database information.