Correlation Rule Commands
getCorrelationRules
Gets a list of correlation rules. Filter arguments support both a single string and a comma-separated list of strings.
Arguments
rule_id
The id(s) of the correlation rule(s).
Optional
name
The name of the correlation rule.
Optional
severity
The severity level. Supports predefined values or the 'SEV_XXX_NAME' format (e.g., SEV_050_CRITICAL). Possible values are: info, low, medium, high, critical, unknown.
Optional
xql_query
The XQL query of the correlation rule.
Optional
is_enabled
Whether the rule is enabled. Possible values are: true, false.
Optional
dataset
The dataset for the correlation rule.
Optional
alert_name
The alert name generated by the rule.
Optional
alert_category
The alert category.
Optional
alert_fields
The alert fields.
Optional
alert_domain
The alert domain.
Optional
filter_json
A JSON string representing filter conditions.
Optional
extra_data
Whether to include extra data in the response. Possible values are: true, false.
Optional
limit
The maximum number of results to return.
Optional
page_size
The number of results per page.
Optional
page
The page number to retrieve.
Optional
Outputs
Core.CorrelationRule.rule_id number
The unique identifier of the correlation rule.
Core.CorrelationRule.name string
The name of the correlation rule.
Core.CorrelationRule.severity string
The severity of the correlation rule.
Core.CorrelationRule.is_enabled boolean
Whether the rule is enabled.
Core.CorrelationRule.description string
The description of the correlation rule.
createCorrelationRule
Creates a correlation rule, which runs the given XQL query on a schedule or in real time and generates an issue when the query returns results.
Arguments
name
The name of the correlation rule.
Required
severity
The severity level. Supports predefined values or the 'SEV_XXX_NAME' format (e.g., SEV_050_CRITICAL). Possible values are: info, low, medium, high, critical, unknown.
Required
xql_query
The XQL query of the correlation rule.
Required
is_enabled
Whether the rule is enabled. Possible values are: true, false.
Optional
description
The description of the correlation rule.
Optional
alert_name
The alert name generated by the rule.
Required
alert_category
The alert category. Possible values are: COLLECTION, CREDENTIAL_ACCESS, DISCOVERY, DROPPER, EVASION, EXECUTION, EXFILTRATION, FILE_PRIVILEGE_MANIPULATION, FILE_TYPE_OBFUSCATION, INFILTRATION, LATERAL_MOVEMENT, OTHER, PERSISTENCE, PRIVILEGE_ESCALATION, RECONNAISSANCE, TAMPERING.
Optional
alert_description
The alert description.
Optional
alert_fields
The alert fields as a JSON object string.
Optional
execution_mode
The execution mode of the rule. Possible values are: SCHEDULED, REAL_TIME.
Optional
search_window
The search window for the rule.
Optional
schedule
The schedule for the rule.
Optional
schedule_linux
The Linux cron schedule for the rule.
Optional
timezone
The timezone for the schedule.
Optional
suppression_enabled
Whether suppression is enabled. Possible values are: true, false.
Optional
suppression_duration
The suppression duration in minutes.
Optional
suppression_fields
The suppression fields.
Optional
dataset
The dataset for the correlation rule.
Optional
user_defined_severity
The user-defined severity.
Optional
user_defined_category
The user-defined category.
Optional
mitre_defs_json
A JSON string representing MITRE definitions.
Optional
investigation_query_link
The investigation query link.
Optional
drilldown_query_timeframe
The drilldown query timeframe.
Optional
mapping_strategy
The mapping strategy. Possible values are: AUTO, CUSTOM.
Optional
alert_type
The alert type.
Optional
action
The action for the correlation rule. Possible values are: ALERTS, DATASET.
Optional
deleteCorrelationRule
Deletes one or more correlation rules by ID. Deleting a rule stops it from generating any further issues.
Arguments
rule_id
A comma-separated list of correlation rule IDs to delete.
Required
Outputs
There are no outputs for this command.
setCorrelationRule
Updates the fields of an existing correlation rule. Only the fields provided are changed.
Arguments
rule_id
The ID of the correlation rule to set.
Required
name
The name of the correlation rule.
Optional
severity
The severity level. Supports predefined values or the 'SEV_XXX_NAME' format (e.g., SEV_050_CRITICAL). Possible values are: info, low, medium, high, critical, unknown.
Optional
xql_query
The XQL query of the correlation rule.
Optional
is_enabled
Whether the rule is enabled. Possible values are: true, false.
Optional
description
The description of the correlation rule.
Optional
alert_name
The alert name generated by the rule.
Optional
alert_category
The alert category. Possible values are: COLLECTION, CREDENTIAL_ACCESS, DISCOVERY, DROPPER, EVASION, EXECUTION, EXFILTRATION, FILE_PRIVILEGE_MANIPULATION, FILE_TYPE_OBFUSCATION, INFILTRATION, LATERAL_MOVEMENT, OTHER, PERSISTENCE, PRIVILEGE_ESCALATION, RECONNAISSANCE, TAMPERING, User Defined.
Optional
alert_description
The alert description.
Optional
alert_fields
The alert fields as a JSON object string.
Optional
execution_mode
The execution mode of the rule. Possible values are: SCHEDULED, REAL_TIME.
Optional
search_window
The search window for the rule.
Optional
schedule
The schedule for the rule.
Optional
schedule_linux
The Linux cron schedule for the rule.
Optional
timezone
The timezone for the schedule.
Optional
suppression_enabled
Whether suppression is enabled. Possible values are: true, false.
Optional
suppression_duration
The suppression duration in minutes.
Optional
suppression_fields
The suppression fields.
Optional
dataset
The dataset for the correlation rule.
Optional
user_defined_severity
The user-defined severity.
Optional
user_defined_category
The user-defined category.
Optional
mitre_defs_json
A JSON string representing MITRE definitions.
Optional
investigation_query_link
The investigation query link.
Optional
drilldown_query_timeframe
The drilldown query timeframe.
Optional
mapping_strategy
The mapping strategy. Possible values are: AUTO, CUSTOM.
Optional
alert_type
The alert type.
Optional
action
The action for the correlation rule. Possible values are: ALERTS, DATASET.
Optional
Outputs
There are no outputs for this command.
getContributingEvents
Returns the contributing events for the specified correlation alerts.
Arguments
alert_ids
A comma-separated list of correlation alert IDs from which to retrieve the contributing events. Large lists may take longer to complete.
Required
limit
The maximum number of contributing events to retrieve per alert. Default is 50.
Optional
page_size
The number of contributing events to return per page, per alert. When set, manual pagination is used and limit is ignored.
Optional
page
The page number to return, per alert, starting from zero. When set, manual pagination is used and limit is ignored.
Optional
Last updated
Was this helpful?