• Output Sets

  • The output of a filter is either the empty set (if the Boolean expression evaluates to false) or a set containing the current event and all of the other events from the incoming set (if the Boolean expression evaluates to true).

  • If filter is the last or only operation of a correlation rule, then the output set of the filter is used to construct a correlated event. The trigger events are the filter operation output set of events with the current event first.

  • If filter is not the last operation of a correlation rule (that is, filter is followed by a flow operatior), then the output set of a filter is used as the input set to other operations (through the flow operator).