Correlation event fields
Correlation events are created by the KUMA Correlators when specified the conditions, set in the Configuration rules are met. The correlation event conforms to the normalized event data model.
Correlation event fields
Field |
Description |
|
Unique identifier |
|
Indicator of the correlation event type. The correlation event corresponds to the value of |
|
Correlation event name. By default, the name of the parent correlation rule (the Correlation rule resource that created the correlation event) is used. This can be changed in the Correlation rule settings in the Enrichment group of settings parameters. |
|
Time and date of correlation event creation. |
|
Identifier of the parent correlation rule that triggered the event. |
|
Name of the parent correlation rule. |
|
Priority of the correlation event |
|
Identifier of the correlator service that created the event. |
|
|
|
|
|
The number of base events that are related to the correlation event. |
|
List of IDs of base events that were used as the basis for the correlation event. For DrillDown. |
|
List of unique addresses, hosts, users, and IDs of assets that were affected by the potential incident |
<Fields that are selected in the Identical fields field in the Correlation rule resource parameters> |
Copied from the events, processed by the Correlation rule. |