Setting Event Attributes

Setting an Event Attribute to a Constant

<setEventAttribute attr="eventSeverity">1</setEventAttribute>

Setting an Event Attribute from another variable

The $ symbol is used to specify the content of a variable. In the example below, attribute hostMACAddr gets the value stored in the local variable _mac.

<setEventAttribute attr="hostMACAddr">$_mac</setEventAttribute>

An example of a function operating on a local variable before storing into an event attribute is:

<setEventAttribute attr="hostMACAddr">normalizeMAC($_mac)</setEventAttribute>

normalizeMAC is a built-in function defined in Compute Functions.

Setting an Event Attribute by regular expression match

Several Collect and Set functions can be used to set event attributes by matching specific regular expressions on an input string.

See the Collect and Set Functions in Built-in Functions.