> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/correlation-rule-commands.md).
# Correlation Rule Commands
* [getCorrelationRules](#getcorrelationrules)
* [createCorrelationRule](#createcorrelationrule)
* [deleteCorrelationRule](#deletecorrelationrule)
* [setCorrelationRule](#setcorrelationrule)
#### getCorrelationRules
***
Gets a list of correlation rules. Filter arguments support both a single string and a comma-separated list of strings.
Arguments
| Argument Name | Description | Required |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| rule\_id | The id(s) of the correlation rule(s). | Optional |
| name | The name of the correlation rule. | Optional |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Optional |
| xql\_query | The XQL query of the correlation rule. | Optional |
| is\_enabled | Whether the rule is enabled. Possible values are: true, false. | Optional |
| dataset | The dataset for the correlation rule. | Optional |
| alert\_name | The alert name generated by the rule. | Optional |
| alert\_category | The alert category. | Optional |
| alert\_fields | The alert fields. | Optional |
| alert\_domain | The alert domain. | Optional |
| filter\_json | A JSON string representing filter conditions. | Optional |
| extra\_data | Whether to include extra data in the response. Possible values are: true, false. | Optional |
| limit | The maximum number of results to return. | Optional |
| page\_size | The number of results per page. | Optional |
| page | The page number to retrieve. | Optional |
Outputs
**Core.CorrelationRule.rule\_id** *number*
The unique identifier of the correlation rule.
**Core.CorrelationRule.name** *string*
The name of the correlation rule.
**Core.CorrelationRule.severity** *string*
The severity of the correlation rule.
**Core.CorrelationRule.is\_enabled** *boolean*
Whether the rule is enabled.
**Core.CorrelationRule.description** *string*
The description of the correlation rule.
#### createCorrelationRule
***
Creates a correlation rule, which runs the given XQL query on a schedule or in real time and generates an issue when the query returns results.
Arguments
| Argument Name | Description | Required |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| name | The name of the correlation rule. | Required |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Required |
| xql\_query | The XQL query of the correlation rule. | Required |
| is\_enabled | Whether the rule is enabled. Possible values are: true, false. | Optional |
| description | The description of the correlation rule. | Optional |
| alert\_name | The alert name generated by the rule. | Required |
| alert\_category | The alert category. Possible values are: COLLECTION, CREDENTIAL\_ACCESS, DISCOVERY, DROPPER, EVASION, EXECUTION, EXFILTRATION, FILE\_PRIVILEGE\_MANIPULATION, FILE\_TYPE\_OBFUSCATION, INFILTRATION, LATERAL\_MOVEMENT, OTHER, PERSISTENCE, PRIVILEGE\_ESCALATION, RECONNAISSANCE, TAMPERING. | Optional |
| alert\_description | The alert description. | Optional |
| alert\_fields | The alert fields as a JSON object string. | Optional |
| execution\_mode | The execution mode of the rule. Possible values are: SCHEDULED, REAL\_TIME. | Optional |
| search\_window | The search window for the rule. | Optional |
| schedule | The schedule for the rule. | Optional |
| schedule\_linux | The Linux cron schedule for the rule. | Optional |
| timezone | The timezone for the schedule. | Optional |
| suppression\_enabled | Whether suppression is enabled. Possible values are: true, false. | Optional |
| suppression\_duration | The suppression duration in minutes. | Optional |
| suppression\_fields | The suppression fields. | Optional |
| dataset | The dataset for the correlation rule. | Optional |
| user\_defined\_severity | The user-defined severity. | Optional |
| user\_defined\_category | The user-defined category. | Optional |
| mitre\_defs\_json | A JSON string representing MITRE definitions. | Optional |
| investigation\_query\_link | The investigation query link. | Optional |
| drilldown\_query\_timeframe | The drilldown query timeframe. | Optional |
| mapping\_strategy | The mapping strategy. Possible values are: AUTO, CUSTOM. | Optional |
| alert\_type | The alert type. | Optional |
| action | The action for the correlation rule. Possible values are: ALERTS, DATASET. | Optional |
Outputs
**Core.CorrelationRule.rule\_id** *string*
The ID of the created/set correlation rule.
#### deleteCorrelationRule
***
Deletes one or more correlation rules by ID. Deleting a rule stops it from generating any further issues.
Arguments
| Argument Name | Description | Required |
| ------------- | --------------------------------------------------------- | -------- |
| rule\_id | A comma-separated list of correlation rule IDs to delete. | Required |
**Outputs**
There are no outputs for this command.
#### setCorrelationRule
***
Updates the fields of an existing correlation rule. Only the fields provided are changed.
Arguments
| Argument Name | Description | Required |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| rule\_id | The ID of the correlation rule to set. | Required |
| name | The name of the correlation rule. | Optional |
| severity | The severity level. Supports predefined values or the 'SEV\_XXX\_NAME' format (e.g., SEV\_050\_CRITICAL). Possible values are: info, low, medium, high, critical, unknown. | Optional |
| xql\_query | The XQL query of the correlation rule. | Optional |
| is\_enabled | Whether the rule is enabled. Possible values are: true, false. | Optional |
| description | The description of the correlation rule. | Optional |
| alert\_name | The alert name generated by the rule. | Optional |
| alert\_category | The alert category. Possible values are: COLLECTION, CREDENTIAL\_ACCESS, DISCOVERY, DROPPER, EVASION, EXECUTION, EXFILTRATION, FILE\_PRIVILEGE\_MANIPULATION, FILE\_TYPE\_OBFUSCATION, INFILTRATION, LATERAL\_MOVEMENT, OTHER, PERSISTENCE, PRIVILEGE\_ESCALATION, RECONNAISSANCE, TAMPERING, User Defined. | Optional |
| alert\_description | The alert description. | Optional |
| alert\_fields | The alert fields as a JSON object string. | Optional |
| execution\_mode | The execution mode of the rule. Possible values are: SCHEDULED, REAL\_TIME. | Optional |
| search\_window | The search window for the rule. | Optional |
| schedule | The schedule for the rule. | Optional |
| schedule\_linux | The Linux cron schedule for the rule. | Optional |
| timezone | The timezone for the schedule. | Optional |
| suppression\_enabled | Whether suppression is enabled. Possible values are: true, false. | Optional |
| suppression\_duration | The suppression duration in minutes. | Optional |
| suppression\_fields | The suppression fields. | Optional |
| dataset | The dataset for the correlation rule. | Optional |
| user\_defined\_severity | The user-defined severity. | Optional |
| user\_defined\_category | The user-defined category. | Optional |
| mitre\_defs\_json | A JSON string representing MITRE definitions. | Optional |
| investigation\_query\_link | The investigation query link. | Optional |
| drilldown\_query\_timeframe | The drilldown query timeframe. | Optional |
| mapping\_strategy | The mapping strategy. Possible values are: AUTO, CUSTOM. | Optional |
| alert\_type | The alert type. | Optional |
| action | The action for the correlation rule. Possible values are: ALERTS, DATASET. | Optional |
**Outputs**
There are no outputs for this command.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/correlation-rule-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.