Actions

This field contains a list of the objects that are used to define artifacts of interest within a state. For more information, see Artifacts of interest.

ActivationTimeLimit

This field defines how long Aurora Focus will wait for events to trigger the event. The recommended default value is -0:00:00:001.

FieldOperators

This field contains the field operators and operands that should be inspected to fulfill the function that is defined in the state. For more information, see Field operators.

Filters

This field defines which event categories, subcategories, and types that Aurora Focus should inspect when trying to fulfill a state. For more information, see Filters.

Function

This field contains the logic function that Aurora Focus must observe to consider a state to be satisfied. For more information, see Functions.

HarvestContributingEvents

This field defines whether Aurora Focus should record the events that satisfy a state. The recommended value is true.

Name

This field defines the name of the state that will be displayed in the UI if the rule is satisfied.

Scope

This field defines the scope in which Aurora Focus looks for relevant events. In most cases, the recommended value is global.

States

This field contains a list of one or more state objects. These objects can be chained.