To reduce partial matches, it would be good to add a condition to the brute force rules requiring the destinationUserName be non-null. Rule fires on empty user names are probably not going to be missed.

Hi What is the reason when I install all the package which L1 nomenclature, all the filters have the contition false, but in the process of installation I don't have any error.

Regards

Hi What is the reason when I install all the package which L1 nomenclature, all the filters have the contition false, but in the process of installation I don't have any error.

Regards

You will need to hook in the product packages to the L1 content. When L1 packages are installed, by default, no product packages are hooked in and that's why the filter conditions are false. A link to the Wiki and docs is under Resources on Marketplace. Here is a link to how to do this: https://hpe-sec.com/foswiki/bin/view/ArcSightActivate/L1EntityMonitoring#Content_Hooks_for_Product_Packages.