Manage correlation rules - View and manage your correlation rules - Administrator Guide - Cortex XDR - Cortex

Manage correlation rules - View and manage your correlation rules - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 3.x Documentation

Product

Cortex XDR

License

Prevent

Pro

Creation date

2024-03-06

Last date published

2025-12-09

Category

Administrator Guide

Abstract

View and manage your correlation rules

View and manage your correlation rules in Detection Rules → Correlation Rules. To manage a Correlation Rule, right-click the Correlation Rule and select an action.

You can also monitor your correlation rule executions with the correlations_auditing data set. For more information, see Monitor correlation rules.

View related alerts: View the alerts generated by this correlation rule in the Alerts page. You can Show alerts in new tab or Show alerts in same tab.
Open in XQL: View the XQL results for the correlation rule in XQL Search. You can Show results in new tab or Show results in same tab.
Execute Rule: Run the rule now without waiting for the scheduled time.
Preview Rule: View the rule before it's executed.
Save as new: Duplicate the correlation rule and save it as a new correlation rule.
Export: Select one or more rules to export to a JSON file.
Disable the selected correlation rule. This option is only available on an active rule.
Enable the selected correlation rule. This option is only available on an inactive rule.
Edit Rule: Edit the rule parameters configured in the Edit Correlation Rule editor.
Delete the correlation rule.
Copy entire row to copy the text from all the fields in a row of a correlation rule.
Show rows with ‘<field value>’ to filter the correlation rules list to only display the correlation rules with a specific field value that you select in the table. On certain fields that are null, this option does not display.
Hide rows with ‘<Rule Description>’: Filter the correlation rules list to hide the correlation cules with a specific field value that you select in the table. On certain fields that are null, this option does not display.