> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/creating-correlation-rules-to-monitor-data-ingestion-health.md).
# Creating correlation rules to monitor data ingestion health
You can build your own monitoring logic for ingestion by creating correlation rules that are specific to your requirements. For example, you can create rules that monitor the data ingestion metrics for a specific source within a specific timeframe.
The following examples can help you to set up your own correlation rules with the data ingestion metrics:
Example 1: No logs collected from a data source for 1 hour
In this example, the correlation runs every hour and calculates the number of logs that are collected for each data source over the previous hour. If no logs are collected for a data source during an aggregation period, a security alert is triggered.
Example XQL:
```programlisting
preset = metrics_view
| comp sum(total_event_count) as total_event_count_sum by _collector_id, _collector_ip,
_collector_name, _final_reporting_device_ip, _final_reporting_device_name,
_broker_device_id, _vendor, _product
| filter total_event_count_sum = 0
```
Addition fields to specify in the correlation rule:
| Field | Value |
| ----------------- | --------------------------------------------------------------- |
| Time Schedule | Hourly |
| Query time frame | 1 Hour |
| Alert Suppression | Select **Enable alert suppression**. |
| Fields | Uncheck **`total_event_rate_sum`**, leave other fields checked. |
| Action | Select **Generate alert**. |
| Severity | High |
Example 2: No logs received from a Firewall for 20 minutes
In this example, the correlation runs every 20 minutes and calculates the number of logs that are received for each firewall in a lookup dataset during the last 20 minutes. If no logs are received from a device during an aggregation period, a security alert is triggered.
Example XQL:
```programlisting
preset = metrics_view
| join conflict_strategy = left type = inner (dataset = ngfw_device_Id_keepalive
| fields _device_id) as devices devices._device_id = _device_id | comp sum(total_event_count)
as total_event_count_sum by _device_id, _product,_vendor
| filter total_event_count_sum = 0
```
Addition fields to specify in the correlation rule:
| Field | Value |
| ----------------- | --------------------------------------------------------------- |
| Time Schedule | Every 20 minutes |
| Query time frame | 20 minutes |
| Alert Suppression | Select **Enable alert suppression**. |
| Fields | Uncheck **`total_event_rate_sum`**, leave other fields checked. |
| Action | Select **Generate alert**. |
| Severity | High |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/creating-correlation-rules-to-monitor-data-ingestion-health.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.