Set data source rule actions

Data source rules have a defined default action. The Receiver assigns this action to the event subtype associated with the rule. You can change this action.

You can set the value of the event subtype per data source rule. This means that you can set rule actions for dashboards, reports, parsing rules, or alarms with different values, such as the outcome of a selective access rule (permit/deny).


  1. On the ESM console, click the Policy Editor icon , then select ReceiverData Source in the Rule Types pane.
  2. Click in the Subtype column for the rule you want to change, then select the new action.
    • Select enable to populate the event subtype with the default action, alert.
    • Select disable, if you don't want to collect events for the corresponding rule.
    • Select any other action to populate the event subtype with that action.