Window compares the current event to a set of past events that are stored in a "window." The events in the window may be all past events for a certain time period, or they may be filtered.
The Boolean expression is a composite of comparison instructions and match instructions with the Boolean operators AND, OR and NOT.
The syntax for window is:
Window (<Boolean expression>[, <filter expression>, <evaluation period>)
Where
<Boolean expression> is an expression comparing a metatag value from the current event to a metatag value from a past event (or a user-specified constant)
<filter expression> is optional and specifies filter criteria for the past events
<evaluation period> specifies the duration for which past events matching the filter expression are maintained, specified in seconds (s), minutes (m), or hours (h). If no letter is specified, seconds are assumed.
For example, this rule detects whether the current event has a source IP address in the specified subnet (208.130.28.0/22) and matches an event(s) that happened within the past 60 seconds.
window(e.sip = w.sip, filter(e.sip match subnet (208.130.28.0/22),60)
As another example, this rule is a domino type of rule. An attacker exploits a vulnerable system and uses it as an attack platform.
window((e.sip = w.dip AND e.dp = w.dp AND e.evt = w.evt), 1h)
This rule identifies a potential security breach after a denial of service attack. The rule fires if the destination of a denial of service attack has a service stopped within 60 seconds of the attack.
filter(e.rv51="Service" and e.rv52="Stop" and e.st = "H") flow window (e.sip = w.dip, filter(e.rv52="Dos"), 60s) flow trigger(1,0))
If any past event evaluates to true with the current event for the simple boolean expression, the output set is the incoming event plus all matching past events.
If no events in the window match the current event for the simple boolean expression, the output set is empty.
If a window is the last or only operation of a correlation rule, then the output set of the window is used to construct a correlated event (the correlated events being the window operation output set of events with the current event first).
You must prepend a metatag name with "e." to specify the current event or with "w." to specify the past events
All window simple Boolean expressions must include a metatag in the form w.[metatag].
For more information about valid filter expressions, see Filter Operation.
Every event coming in to the Correlation Engine that passes this filter is put into the window of past events
If no filter expression exists, then all events coming into the Correlation Engine are maintained by the window. With extremely high event rates or long durations, this may require a large amount of memory.
The current event is not placed into the window until after the current event window evaluation is complete
To minimize memory usage, only the relevant parts of the past events, not all metatag values, are maintained in memory.