Deciding what events to configure

Supported in:

For full information on mapping events and creating visual families, refer to Ontology Overview.

To add a model family or map new fields from the Cases screen:

  1. Select a case from the case queue and navigate to the Alert > Events tab.
  2. Click the wheel icon on the right of the event to which you want to assign the visual family or the mapping.
  3. Continue to Event Configuration for more details.

Need more help? Get answers from Community members and Google SecOps professionals.