Migrate Common Events

The purpose of the Common Event Change Manager is to assist in the migration of the Common Events in your affected objects. There are two types of objects you need to migrate if they contain changed Common Events:

• System Objects with Custom filters: Primary, Include, and/or Exclude filters
• Custom objects

LogRhythm recommends that you choose the Common Event to MPE Rule migration option for System Objects to retain the behavior of the initial object.

• If you migrate Common Event to Common Event, multiple Common Events may result where there was previously only one.
• If you migrate Common Event to MPE Rule, a large list of MPE Rules may result. This list may be harder to maintain in the future, but may also more accurately reflect the old filter behavior.

Migrate Common Events With a Preview

1. Right-click the Common Event Change Manager grid, and then click Migrate With Preview.
2. Click either Common Event To Common Event or Common Event To MPE Rule.

Migrate Common Events Without a Preview

1. Right-click the Common Event Change Manager grid, and then click Action.
2. Click either Migrate Common Event To Common Event or Migrate Common Event To MPE Rule.
   A confirmation dialog box appears.
3. To confirm your selection, click Yes.