Simulate event processing
You can simulate event processing logic on events and display the resulting alert to better understand which rules are executed on a given event and how the event fields change after the rule is executed.
Before you begin
Role required: evt_mgmt_admin
About this task
To automatically filter out irrelevant alerts or transform and standardize alert data for better response, you can also use Ignore automation and Enrich automation.
Procedure
- Navigate to .
- Open the event you want to simulate.
- In the Related Links section, select Simulate event processing.
- In the info message that appears at the top of the screen, select the link to the created simulated alert.
- Optional: View which event rules and event field mapping rules were applied and the event field values by selecting the Activities tab.