Simple correlation rules are used to define simple sequences of events.
The correlation rule window contains the following settings tabs:
General tab
If correlation rules employing complex logic for pattern detection are not triggered, this may be due to the specific method used to count rule triggers in KUMA. In this case, try to increase the value of Rate limit to 1000000
, for example.
Low
.Selectors tab
A rule of the simple kind can have only one selector for which the Settings and Local variables tabs are available.
The Settings tab contains settings with the Filter group of settings:
Creating a filter in resources
Filtering based on data from the Extra event field
The order of conditions specified in the selector filter of the correlation rule is significant and affects system performance. We recommend putting the most unique condition in the first place in the selector filter.
Consider two examples of selector filters that select successful authentication events in Microsoft Windows.
Selector filter 1:
Condition 1. DeviceProduct = Microsoft Windows
Condition 2. DeviceEventClassID = 4624
Selector filter 2:
Condition 1. DeviceEventClassID = 4624
Condition 2. DeviceProduct = Microsoft Windows
The order of conditions in Selector filter 2 is preferable because it causes less load on the system.
Select the Local variables tab and click Add variable to declare variables that you want to use within the limits of this correlation rule.
Actions tab
A rule of the simple kind can have only one trigger: On every event. It is activated every time the selector triggers.
Available parameters of the trigger:
If both check boxes are selected, the correlation rule will be sent for post-processing first and then to the current correlation rule selectors.
Available types of enrichment:
Available settings:
The active list entry key depends on the available fields and does not depend on the order in which they are displayed in the KUMA web interface.
The field must not contain special characters or numbers only.
Available settings:
The composite key of the context table entry depends only on the values of fields and does not depend on the order in which they are displayed in the KUMA web interface.
The field must not contain a field name that is already used in the mapping, tab characters, special characters, or only numerals. The maximum number of characters is 128. The name cannot begin with an underscore.
Correlators tab