Step 11. Create and Assign Normalized-Message Fields

For an introduction to Normalized-Message fields, see How does Log-Message Normalization work?.

In this optional Step, you can create a customized Normalized-Message Field and assign it as a condition in a Decision or Output in a Correlation Rule.

To create a Normalized-Message Field:

In the side bar, select Resources >

Configuration Manager.

In the side bar of the Configuration Manager, select

Correlation > Normalized-Message Fields button

Normalized-Message Fields.

Click

Add.

Complete the Normalized-Message Field dialog (see Fields in the Normalized-Message Field dialog) and click OK.

To add the Normalized-Message Field to a Decision or Output in a Correlation Rule, see Defining a Correlation Rule.

Table 39. Fields in the Normalized-Message Field dialog
Field	Description
Key	A unique ID of your choosing for the Normalized-Message field. The Key can only consist of lower-case letters, numbers, and the underscore character (_).
Name	A name of your choosing for the Normalized-Message field. The Name will appear in the Normalized-Message Field drop-down of both the Decision Settings tab and the Action Settings tab in the Settings panel of the Correlation Rule tab (see Table 95).
Type	The type of Normalized-Message field (e.g., a string, a number, an IP address, or a port number).