> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule/monitor-correlation-rules.md). # Monitor correlation rules {% hint style="info" %} ### License Type This functionality is available in Cortex XDR Pro only. {% endhint %} Cortex XDR audits all correlation executions in the `correlations_auditing` dataset. The dataset records the query initiation times, end times, retry attempts, failure reasons, and other useful metrics. . In the `correlations_auditing` dataset, audit entries are added as follows: * The rule starts executing. This is audited with the status of **Initiated** or **Initiated Manually**. * The rule completes successfully. This is audited as **Completed**. * The rule completes with errors. This is audited as **Error**. {% hint style="info" %} ### Note In the dataset, the **Query start time** and **Query end time** indicate the time frame of the data that was queried. The actual start and end times of the correlation rule execution are recorded in the **\_time** field for the **Initiated** and **Completed** entries. {% endhint %}
Field descriptions for the correlations_auditing dataset The following table describes the fields in the correlations\_auditing dataset: | Field | Description | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | \_time |

Timestamp of the audit.

For entries with an Initiated or Initiated Manually status, this is the start time of the correlation rule execution. For entries with a Completed or Error status, this is the end time of the rule execution.

| | \_id | Unique identifier of the audit entry. | | Rule ID | Unique identification number for the correlation rule. | | Name | Correlation rule name. | | Status |

The status of the correlation rule query.

Possible values are Initiated, Initiated Manually, Completed, and Error.

| | Query start time | The start time of the query time frame. | | Query end time | The end time of the query time frame. | | Time frame | Time frame for the query. | | Failure reason | For correlation rules with errors, this field displays the error message. | | Retry attempts | Number of retry attempts before the query initiated or failed to run. | | Schedule | Scheduled frequency to execute the correlation rule. | | Rule creation time | Date and time that the correlation rule was created. | | Rule modification time | Date and time that the correlation rule was last modified. | | Description | Description of the correlation rule. | | Severity | Defined severity of the correlation rule. | | Dataset | Target data set, as defined in the correlation rule | | Suppression status | Whether alert suppression is Enabled or Disabled. | | Suppression duration | Duration for which to ignore additional events that match the alert suppression criteria. | | Suppression fields | Fields on which the alert suppression is based. | | Timezone | Timezone on which the scheduled frequency is based. | | MITRE ATT\&CK Tactic | MITRE ATT\&CK tactic that the correlation rule attempted to trigger. | | MITRE ATT\&CK Technique | MITRE ATT\&CK technique that the correlation rule attempted to trigger. | | Alert category | Category of alert as configured when creating the rule. | | Source | Source of the correlation rule. | | XQL search | XQL query for the correlation rule. | | Drill-down query | XQL query configured for further investigation. | | Alert name | Name of the alert that the correlation rule will trigger. |
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule/monitor-correlation-rules.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.