Administration Guide › Suppression and Summarization › Suppression and Summarization Rules Tasks › How to Create a Summarization Rule › Select an Event for Summarization

Select an Event for Summarization

Specify the native event that you want the rule to summarize by setting a simple filter for the CEG event normalization fields. These four fields, which are part of the event-specific class, are provided for all events expressed in the CEG, allowing you to identify an event.

You can specify the combination of event normalization fields you want using the Simple Filters tab. You can also use advanced filters for further detail in event identification. Specify at least one simple filter for a suppression rule.

To select a summarization rule event

1. Open the summarization wizard and advance to the Filtering step.
2. Create simple filters to select the event you want by selecting the appropriate check box, and then selecting or entering the value you want. The available fields are as follows:

   Ideal Model

   Describes the broad class of technology involved in the event. For example, Firewall and Network Device are idea models.

   Event Category

   Describes broad categories of events. For example, all account, user group, and role-related events are recorded under the "Identity Management" Event Category. Each Event Category has one or more classes (subcategories), so any choice changes the available selections in Event Class menu.

   Event Class

   Provides a more detailed classification of events in a specific event category. For example, Identity Management events are divided into one of three classes: account, group, or identity. Each Event Class has one or more associated actions, so any choice changes the available selections in Event Action menu.

   Event Action

   Describes common actions for each Event Category and Class. For example, Account Management, a class of the Identity Management category, contains account creation, deletion, and modification actions.

3. Click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

   If you click Save and Close, the new rule appears in the list, otherwise the step you select appears.

More information:

Create a Simple Event Filter

Create an Advanced Event Filter

Configure a Summarization Display

Set Summarization Thresholds