Manage correlation rules - Administrator Guide - Cortex XSIAM - Cortex

Manage correlation rules - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product

Cortex XSIAM

Creation date

2024-07-16

Last date published

2025-02-27

Category

Administrator Guide

Retire_Doc

Retiring

Link_to_new_Doc

/r/Cortex-XSIAM/Cortex-XSIAM-Documentation

Abstract

View and manage your correlation rules

View and manage your correlation rules in Detection Rules → Correlation Rules. To manage a Correlation Rule, right-click the Correlation Rule and select an action.

You can also monitor your correlation rule executions with the correlations_auditing data set. For more information, see Monitor correlation rules.

- View related alerts: View the alerts generated by this correlation rule in the Alerts page. You can Show alerts in new tab or Show alerts in same tab.
- Open in XQL: View the XQL results for the correlation rule in XQL Search. You can Show results in new tab or Show results in same tab.
- Execute Rule: Run the rule now without waiting for the scheduled time.
  Note
  Execute Rule is not available for real time correlation rules.
- Preview Rule: View the rule before it's executed.
- Save as new: Duplicate the correlation rule and save it as a new correlation rule.
- Export: Select one or more rules to export to a JSON file.
- Disable the selected correlation rule. This option is only available on an active rule.
- Enable the selected correlation rule. This option is only available on an inactive rule.
- Edit Rule: Edit the rule parameters configured in the Edit Correlation Rule editor.
- Delete the correlation rule.
- Copy entire row to copy the text from all the fields in a row of a correlation rule.
- Show rows with ‘<field value>’ to filter the correlation rules list to only display the correlation rules with a specific field value that you select in the table. On certain fields that are null, this option does not display.
- Hide rows with ‘<Rule Description>’: Filter the correlation rules list to hide the correlation cules with a specific field value that you select in the table. On certain fields that are null, this option does not display.

Note