Simulate event processing

You can simulate event processing logic on events and display the resulting alert to better understand which rules are executed on a given event and how the event fields change after the rule is executed.

Before you begin

Role required: evt_mgmt_admin

About this task

To automatically filter out irrelevant alerts or transform and standardize alert data for better response, you can also use Ignore automation and Enrich automation.

Procedure

1. Navigate to All > Event Management > All Events.

2. Open the event you want to simulate.

3. In the Related Links section, select Simulate event processing.

4. In the info message that appears at the top of the screen, select the link to the created simulated alert.

5. View which event rules and event field mapping rules were applied and the event field values by selecting the Activities tab.

Parent Topic:Event rules