New docs portal launching December 21st! All Exabeam, LogRhythm, and API documentation is moving to docs.exabeam.com. Existing links will redirect automatically, but we recommend updating your bookmarks.
7.26.0 7.25.0 7.24.0 7.23.0 7.22.0 7.21.0 7.20.0 7.19.0 7.18.0
7.26.0 7.25.0 7.24.0 7.23.0 7.22.0 7.21.0 7.20.0 7.19.0 7.18.0

Define AI Engine Linked Data Block Relationships

A Linked Data Block Relationship is similar to a Rule Block Relationship, but only applies the relationship between a Rule Block and an associated Linked Data Block. The relationship always involves linked Group By fields, as with a Rule Block Relationship. Depending on the types of blocks involved, it may also be possible to specify whether a result record is required or optional on each side of the relationship. Linked Data Block Relationships do not involve time, so unlike a Rule Block Relationship, there are no time parameters.

  1. Complete the information on the AI Engine Rule Block Relationship window:

    1. Related Fields. The options in the list are the Group By boxes designated in the rule block. For example, if the Rule Block 1 field is a Sender, then it can only be related to a Recipient in Rule Block 2.

      • To select an option in the first column, click the down-arrow at the end of the field or click Add.

      • To select an option in the last column, click the down-arrow at the end of the field. Only boxes compatible with the first column option will be available.

    2. Related Data Not Observed options (Advanced) . Select whether a data item is required in the Live data (on left) or the Linked data (on right). When not required, absent values are treated as 0/empty in expressions. By default, both Live data and Linked data are disabled. Click the question mark for a detailed explanation of this behavior.

  2. Click OK.