Manage correlation rules

Manage Cortex XSIAM correlation rules, including rule settings, status, and configuration.

View and manage your correlation rules in Threat Management → Detection Rules → Correlations. To manage a Correlation Rule, right-click the Correlation Rule and select an action.

Note The maximum number of active scheduled correlations is 1200. This limit applies only to enabled, user-created scheduled correlations. If your organizational needs exceed this limit, please contact your support agent.

You can also monitor your correlation rule executions with the correlations_auditing data set. For more information, see Monitor correlation rules.

Right-click actions for managing correlation rules

• View related issues: View the issues generated by this correlation rule in the Issues page. You can Show issues in new tab or Show issues in same tab.

• Open in XQL: View the XQL results for the correlation rule in XQL Search. You can Show results in new tab or Show results in same tab.

• Execute Rule: Run the rule now without waiting for the scheduled time.

  Note

  Execute Rule is not available for real time correlation rules.

• Preview Rule: View the rule before it's executed.

• Save as new: Duplicate the correlation rule and save it as a new correlation rule.

• Export: Select one or more rules to export to a JSON file.

• Disable the selected correlation rule. This option is only available on an active rule.

• Enable the selected correlation rule. This option is only available on an inactive rule.

• Edit Rule: Edit the rule parameters configured in the Edit Correlation Rule editor.

• Delete the correlation rule.

• Copy entire row to copy the text from all the fields in a row of a correlation rule.

• Show rows with ‘<field value>’ to filter the correlation rules list to only display the correlation rules with a specific field value that you select in the table. On certain fields that are null, this option does not display.

• Hide rows with ‘<Rule Description>’: Filter the correlation rules list to hide the correlation rules with a specific field value that you select in the table. On certain fields that are null, this option does not display.