I don't have a 10.5 server in front of me - I'm currently looking at 10.6 - but I looked at the admin guide for 10.5 and I think the instructions haven't changed. When you open the Alert entity editor, go to the Authorization tab. Select and existing group entry or add a new group entry. In the conditions row, click in the left-hand side dropdown and choose the column "Enrichment data..." That will open a popup dialog where you enter the enrichment field name (see image 1 below). Click ok. The dialog will fill in the left-hand side of the condition. Enter the value you want to match on the right-hand side like any other rule (see image 2 below). Enrichment field dialog Completed security rule
... View more