Hi, Thanks for the help, it clarify a lot the tasks I have to do.

Just one more thing, if I want to add a simple keyword it's just to write it down, with no "" or () or anything else?

Because I have done that, and triggered an event with the keyword but when I do a query for all matching events on that rule, nothing comes out.

and if i make a query with all matching events form a server, there is an event with the keyword I've defined.

Thanks

"if I want to add a simple keyword it's just to write it down, with no "" or () or anything else? "

yes.

"Because I have done that, and triggered an event with the keyword but"

creating inspection rules are a little wierd at first. When to use values of none/any/etc is not very clear. I would start with a query t find the matching event. Use a result format of "all matching events" and select the "real time" filter. Enter your keyword and then submit. Now generate the event on the reporting device. You should see it in the query. If you do, let's make a rule out of it. Edit the query type and change the filter to "last 10 minutes". Click apply. Now click "Save as rule". Enter the rest of the rule information and submit it.