Viewing correlation event details

You can view the details of a correlation event in the Correlation event details window.

To view information about a correlation event:

In the Events section of the KUMA web interface, click a correlation event.
You can use filters to find correlation events by assigning the correlated value to the Type parameter.

The details area of the selected event will open. If the selected event is a correlation event, the Detailed view button will be displayed at the bottom of the details area.
Click the Detailed view button.

The correlation event window will open. The event name is displayed in the upper left corner of the window.

The Correlation event details section of the correlation event window contains the following data:

Correlation event severity—the importance of the correlation event.
Correlation rule—the name of the correlation rule that triggered the creation of this correlation event. The rule name is represented as a link that can be used to open the settings of this correlation rule.
Correlation rule severity—the importance of the correlation rule that triggered the correlation event.
Correlation rule ID—the identifier of the correlation rule that triggered the creation of this correlation event.
Tenant—the name of the tenant that owns the correlation event.

The Related events section of the correlation event window contains the table of events related to the correlation event. These are base events that actually triggered the creation of the correlation event. When an event is selected, the details area opens in the right part of the web interface window.

The Find in events link to the right of the section header is used for alert investigation.

The Related endpoints section of the correlation event window contains the table of hosts related to the correlation event. This information comes from the base events related to the correlation event. Clicking the name of the asset opens the Asset details window.

The Related users section of the correlation event window contains the table of users related to the correlation event. This information comes from the base events related to the correlation event.