Testing a Rule
After you’ve created or a edited a rule, you should test it to see if behave as expected before you activate it. This topic describes how to test a rule using synthetic events.
Procedure
Test Results
Test Example
Troubleshooting for Rule Testing
Rule Syntax Error
Rule Semantics Error
Event Parsing Error
Procedure
- Go to Analytics > Rules, and deactivate the rule you want to test.
- Select the rule, and then click Test Rule.
This will open the Rule Debugger.
- Enter a Reporting IP where the synthetic event should originate from.
- Under Raw Event, enter the raw event log text that contains the triggering conditions for the rule.
- Under Pause, enter the number of seconds before the next test event will be sent, and then click + under Action to enter additional test events.
You will need to create as many events as are necessary to trigger the rule conditions.
- Click Run Test.
If the test succeeds you are now ready to activate the rule.
Test Results
The test will run through a four stage process, which you can observe in the Test Results tab of the rule. A yellow icon will also appear in the Stat us column for the rule to indicate that the test is running.
- Rules are checked for syntax errors.
- Events are parsed and sent to Rule Workers.
If there are errors in the rule syntax or event parsing errors, see the examples under Troubleshooting for Rule Testing for suggestions on how to correct them. As events are being parsed, you can view their Event Details by clicking on the Raw Event Log icon next to the event.
- Rule Worker nodes evaluate the events against the rule conditions, and if they match, they are sent to the Rule Master.
- The Rule Master creates incidents, which then appear in the Incidents dashboards.
When the test successfully completes, a green icon will appear in the Status column next to the rule name.
Test Example
This screenshot shows the example of a test for the rule Multiple Admin Login Failures: Net Devices. The conditions for this rule are that the the Reporting IP must belong to a network device, and there must be 3 login failure events from the same IP and user.
Troubleshooting for Rule Testing
If the test fails, a red icon will appear under the Status column next to the rule name, and you will see the error message in the Test Results tab for the rule.
Rule Syntax Error
Rule Semantics Error
This means that the conditions of the rule were not met by the event. For example, if five events were required to meet the condition, but only one was sent.
Event Parsing Error
This means that some text in the raw event log did not pass the event parser. For example, if “denied” is the term expected by the parser in the test example, but the raw event log contains the term “deny,” then the event will not pass the parser.