Create, edit, and manage correlation rules.
View and manage your correlation rules in Threat Management → Detection Rules → Correlations. To manage a Correlation Rule, right-click the Correlation Rule and select an action.
Note The maximum number of active scheduled correlations is 1200. This limit applies only to enabled, user-created scheduled correlations. If your organizational needs exceed this limit, please contact your support agent.
You can also monitor your correlation rule executions with the correlations_auditing data set. For more information, see Monitor correlation rules.
View related issues: View the issues generated by this correlation rule in the Issues page. You can Show issues in new tab or Show issues in same tab.
Open in XQL: View the XQL results for the correlation rule in XQL Search. You can Show results in new tab or Show results in same tab.
Execute Rule: Run the rule now without waiting for the scheduled time.
Preview Rule: View the rule before it's executed.
Save as new: Duplicate the correlation rule and save it as a new correlation rule.
Export: Select one or more rules to export to a JSON file.
Disable the selected correlation rule. This option is only available on an active rule.
Enable the selected correlation rule. This option is only available on an inactive rule.
Edit Rule: Edit the rule parameters configured in the Edit Correlation Rule editor.
Delete the correlation rule.
Copy entire row to copy the text from all the fields in a row of a correlation rule.
Show rows with ‘’ to filter the correlation rules list to only display the correlation rules with a specific field value that you select in the table. On certain fields that are null, this option does not display.
Hide rows with ‘’: Filter the correlation rules list to hide the correlation cules with a specific field value that you select in the table. On certain fields that are null, this option does not display.
Last updated
Was this helpful?
Was this helpful?
