You can investigate the events created by an alert.
When investigating an alert generated by a correlation rule, you can view all of the events created for the alert. You can have up to 1000 events per correlation rule.
In addition, if the correlation rule includes a drilldown query you can run the query in the Query Builder. The drilldown query provides additional information about an alert for further investigation.
From the Alerts page, locate an alert created by a correlation rule.
Right-click the row, and select → .
(Optional) Open the drilldown query, if available.
Right-click the row and select → .
The drilldown query can accept parameters from the alert output for the correlation rule. In addition, the alert time frame used to run the drilldown query provides more details about the alert generated by the correlation rule. The alert time frame is the minimum and maximum timestamps of the events for the alert. If there is only one event, the event timestamp is the time frame used for the query.