The properties of global variables differ from the properties of local variables.
Global variables:
Global variables are declared at the correlator level and are applied only within the scope of this correlator.
The global variables of the correlator can be queried from all correlation rules that are specified in it.
In standard correlation rules, the same global variable can take different values in each selector.
It is not possible to transfer global variables between different correlators.
Local variables:
Local variables are declared at the correlation rule level and are applied only within the limits of this rule.
In standard correlation rules, the scope of a local variable consists of only the selector in which the variable was declared.
Local variables can be declared in any type of correlation rule.
Local variables cannot be transferred between rules or selectors.
A local variable cannot be used as a global variable.
Variables used in various types of correlation rules
In operational correlation rules, on the Actions tab, you can specify all variables available or declared in this rule.
In standard correlation rules, on the Actions tab, you can provide only those variables specified in these rules on the General tab, in the Identical fields field.
In simple correlation rules, on the Actions tab, you can provide only those variables specified in these rules on the General tab, in the Inherited Fields field.