SEM / LEM rule creation basics

[venkythiru]

Hi there...I have worked on LEM before, but its been awhile. I am trying to find if I create a rule and not specify a group to target for systems or users, will that rule apply for every nodes thats added in the LEM ? Can you please advice me in that ? I have been watching videos about creating rules, but when tried to search for that specific part of rule creation, I couldnt find. Hence please let me know. Appreciate your input.

[venkythiru]

jrouviere​, thank you for your reply. tstark@logixhealth.com​, it was just a general question, but didnt have any specific clarification in a rule.

[jrouviere]

Sounds right.

Take a simple rule, logon failure. If you specify the event type, but nothing for source/destination machine, etc, it will apply to every machine/group.

If you want to limit it to a specific group, you need to add that into the rule correlation.

[tstark]

I advise posting a screenshot of your rule.