Triggers define output of correlators.
They live in the
trigger section of the correlator.
Each correlator can define many triggers (it is a list).
The trigger can access the original event by
!EVENT statement, it is the last event that passed evaluation test.
The value from the aggregator function is availabe at
This trigger inserts a new event into the primary data path.
Example of the event trigger:
trigger: - event: !DICT set: AnalyzeValue: !ARG LastEvent: !EVENT AnotherAttribute: Foo
Lookup trigger manipulates with the content of the lookup. It means that it can add (set) and remove (unset) an entry in the lookup.
The entry is identified by a
key, which is a unique primary key.
Example of the trigger that adds an entry to the lookup
trigger: - lookup: UserList key: !ITEM EVENT UserName set: Timestamp: !NOW Foo: Bar
Example of the trigger that removes an entry from the lookup
trigger: - lookup: UserList delete: !ITEM EVENT UserName
Remark: Lookup entries can be accessed from the declarative expressions by