> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/correlation-rule-commands.md).
# Correlation Rule Commands
* [getCorrelationRules](#getcorrelationrules)
* [createCorrelationRule](#createcorrelationrule)
* [deleteCorrelationRule](#deletecorrelationrule)
* [setCorrelationRule](#setcorrelationrule)
* [getContributingEvents](#getcontributingevents)
#### getCorrelationRules
***
Gets a list of correlation rules. Filter arguments support both a single string and a comma-separated list of strings.
Arguments
| Argument Name | Description | Required |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| rule\_id | The id(s) of the correlation rule(s). | Optional |
| name | The name of the correlation rule. | Optional |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Optional |
| xql\_query | The XQL query of the correlation rule. | Optional |
| is\_enabled | Whether the rule is enabled. Possible values are: true, false. | Optional |
| dataset | The dataset for the correlation rule. | Optional |
| alert\_name | The alert name generated by the rule. | Optional |
| alert\_category | The alert category. | Optional |
| alert\_fields | The alert fields. | Optional |
| alert\_domain | The alert domain. | Optional |
| filter\_json | A JSON string representing filter conditions. | Optional |
| extra\_data | Whether to include extra data in the response. Possible values are: true, false. | Optional |
| limit | The maximum number of results to return. | Optional |
| page\_size | The number of results per page. | Optional |
| page | The page number to retrieve. | Optional |
Outputs
**Core.CorrelationRule.rule\_id** *number*
The unique identifier of the correlation rule.
**Core.CorrelationRule.name** *string*
The name of the correlation rule.
**Core.CorrelationRule.severity** *string*
The severity of the correlation rule.
**Core.CorrelationRule.is\_enabled** *boolean*
Whether the rule is enabled.
**Core.CorrelationRule.description** *string*
The description of the correlation rule.
#### createCorrelationRule
***
Creates a correlation rule, which runs the given XQL query on a schedule or in real time and generates an issue when the query returns results.
Arguments
| Argument Name | Description | Required |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| name | The name of the correlation rule. | Required |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Required |
| xql\_query | The XQL query of the correlation rule. | Required |
| is\_enabled | Whether the rule is enabled. Possible values are: true, false. | Optional |
| description | The description of the correlation rule. | Optional |
| alert\_name | The alert name generated by the rule. | Required |
| alert\_category | The alert category. Possible values are: COLLECTION, CREDENTIAL\_ACCESS, DISCOVERY, DROPPER, EVASION, EXECUTION, EXFILTRATION, FILE\_PRIVILEGE\_MANIPULATION, FILE\_TYPE\_OBFUSCATION, INFILTRATION, LATERAL\_MOVEMENT, OTHER, PERSISTENCE, PRIVILEGE\_ESCALATION, RECONNAISSANCE, TAMPERING. | Optional |
| alert\_description | The alert description. | Optional |
| alert\_fields | The alert fields as a JSON object string. | Optional |
| execution\_mode | The execution mode of the rule. Possible values are: SCHEDULED, REAL\_TIME. | Optional |
| search\_window | The search window for the rule. | Optional |
| schedule | The schedule for the rule. | Optional |
| schedule\_linux | The Linux cron schedule for the rule. | Optional |
| timezone | The timezone for the schedule. | Optional |
| suppression\_enabled | Whether suppression is enabled. Possible values are: true, false. | Optional |
| suppression\_duration | The suppression duration in minutes. | Optional |
| suppression\_fields | The suppression fields. | Optional |
| dataset | The dataset for the correlation rule. | Optional |
| user\_defined\_severity | The user-defined severity. | Optional |
| user\_defined\_category | The user-defined category. | Optional |
| mitre\_defs\_json | A JSON string representing MITRE definitions. | Optional |
| investigation\_query\_link | The investigation query link. | Optional |
| drilldown\_query\_timeframe | The drilldown query timeframe. | Optional |
| mapping\_strategy | The mapping strategy. Possible values are: AUTO, CUSTOM. | Optional |
| alert\_type | The alert type. | Optional |
| action | The action for the correlation rule. Possible values are: ALERTS, DATASET. | Optional |
Outputs
**Core.CorrelationRule.rule\_id** *string*
The ID of the created/set correlation rule.
#### deleteCorrelationRule
***
Deletes one or more correlation rules by ID. Deleting a rule stops it from generating any further issues.
Arguments
| Argument Name | Description | Required |
| ------------- | --------------------------------------------------------- | -------- |
| rule\_id | A comma-separated list of correlation rule IDs to delete. | Required |
**Outputs**
There are no outputs for this command.
#### setCorrelationRule
***
Updates the fields of an existing correlation rule. Only the fields provided are changed.
Arguments
| Argument Name | Description | Required |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| rule\_id | The ID of the correlation rule to set. | Required |
| name | The name of the correlation rule. | Optional |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Optional |
| xql\_query | The XQL query of the correlation rule. | Optional |
| is\_enabled | Whether the rule is enabled. Possible values are: true, false. | Optional |
| description | The description of the correlation rule. | Optional |
| alert\_name | The alert name generated by the rule. | Optional |
| alert\_category | The alert category. Possible values are: COLLECTION, CREDENTIAL\_ACCESS, DISCOVERY, DROPPER, EVASION, EXECUTION, EXFILTRATION, FILE\_PRIVILEGE\_MANIPULATION, FILE\_TYPE\_OBFUSCATION, INFILTRATION, LATERAL\_MOVEMENT, OTHER, PERSISTENCE, PRIVILEGE\_ESCALATION, RECONNAISSANCE, TAMPERING, User Defined. | Optional |
| alert\_description | The alert description. | Optional |
| alert\_fields | The alert fields as a JSON object string. | Optional |
| execution\_mode | The execution mode of the rule. Possible values are: SCHEDULED, REAL\_TIME. | Optional |
| search\_window | The search window for the rule. | Optional |
| schedule | The schedule for the rule. | Optional |
| schedule\_linux | The Linux cron schedule for the rule. | Optional |
| timezone | The timezone for the schedule. | Optional |
| suppression\_enabled | Whether suppression is enabled. Possible values are: true, false. | Optional |
| suppression\_duration | The suppression duration in minutes. | Optional |
| suppression\_fields | The suppression fields. | Optional |
| dataset | The dataset for the correlation rule. | Optional |
| user\_defined\_severity | The user-defined severity. | Optional |
| user\_defined\_category | The user-defined category. | Optional |
| mitre\_defs\_json | A JSON string representing MITRE definitions. | Optional |
| investigation\_query\_link | The investigation query link. | Optional |
| drilldown\_query\_timeframe | The drilldown query timeframe. | Optional |
| mapping\_strategy | The mapping strategy. Possible values are: AUTO, CUSTOM. | Optional |
| alert\_type | The alert type. | Optional |
| action | The action for the correlation rule. Possible values are: ALERTS, DATASET. | Optional |
**Outputs**
There are no outputs for this command.
#### getContributingEvents
***
Returns the contributing events for the specified correlation alerts.
Arguments
| Argument Name | Description | Required |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| alert\_ids | A comma-separated list of correlation alert IDs from which to retrieve the contributing events. Large lists may take longer to complete. | Required |
| limit | The maximum number of contributing events to retrieve per alert. Default is 50. | Optional |
| page\_size | The number of contributing events to return per page, per alert. When set, manual pagination is used and limit is ignored. | Optional |
| page | The page number to return, per alert, starting from zero. When set, manual pagination is used and limit is ignored. | Optional |
Outputs
**Core.ContributingEvent.alertID** *string*
The correlation alert ID.
**Core.ContributingEvent.events** *unknown*
The contributing events for the alert.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/correlation-rule-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.