> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/manage-correlation-rules.md). # Manage correlation rules Manage Cortex XSIAM correlation rules, including rule settings, status, and configuration. View and manage your correlation rules in **Threat Management → Detection Rules → Correlations**. To manage a Correlation Rule, right-click the Correlation Rule and select an action. {% hint style="info" %} **Note**\ The maximum number of active scheduled correlations is 1200. This limit applies only to enabled, user-created scheduled correlations. If your organizational needs exceed this limit, please contact your support agent. {% endhint %} You can also monitor your correlation rule executions with the `correlations_auditing` data set. For more information, see [Monitor correlation rules](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/about-health-issues/monitor-correlation-rules.md).
Right-click actions for managing correlation rules * **View related issues:** View the issues generated by this correlation rule in the **Issues** page. You can **Show issues in new tab** or **Show issues in same tab**. * **Open in XQL:** View the XQL results for the correlation rule in XQL Search. You can **Show results in new tab** or **Show results in same tab**. * **Execute Rule:** Run the rule now without waiting for the scheduled time.

Note

Execute Rule is not available for real time correlation rules.

* **Preview Rule:** View the rule before it's executed. * **Save as new:** Duplicate the correlation rule and save it as a new correlation rule. * **Export:** Select one or more rules to export to a JSON file. * **Disable** the selected correlation rule. This option is only available on an active rule. * **Enable** the selected correlation rule. This option is only available on an inactive rule. * **Edit Rule**: Edit the rule parameters configured in the **Edit Correlation Rule** editor. * **Delete** the correlation rule. * **Copy entire row** to copy the text from all the fields in a row of a correlation rule. * **Show rows with ‘\’** to filter the correlation rules list to only display the correlation rules with a specific field value that you select in the table. On certain fields that are null, this option does not display. * **Hide rows with ‘\’:** Filter the correlation rules list to hide the correlation rules with a specific field value that you select in the table. On certain fields that are null, this option does not display.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/manage-correlation-rules.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.