Correlation rules

Correlation rules are used to recognize specific sequences of processed events and to take certain actions after recognition, such as creating correlation events/alerts or interacting with an active list.

Correlation rules can be used in the following KUMA services and features:

• Correlator.
• Notification rule.
• Links of segmentation rules.
• Retroscan.

The available correlation rule settings depend on the selected type. Types of correlation rules:

• standard—used to find correlations between multiple events. Resources of this kind can create correlation events.

  This rule kind is used to determine complex correlation patterns. For simpler patterns you should use other correlation rule kinds that require less resources to operate.

• simple—used to create correlation events if a certain event is found.
• operational—used for operations with Active lists and context tables. This rule kind cannot create correlation events.

For these resources, you can enable the display of non-printing characters in all input fields except the Description field.

If a correlation rule is used in the correlator and an alert was created based on it, any change to the correlation rule does not result in a change to the existing alert even if the correlator service is restarted. For example, if the name of a correlation rule is changed, the name of the alert remains the same If you close the existing alert, the newly created alert takes into account the changes made to the correlation rule.

In this section Standard correlation rules Simple correlation rules Operational correlation rules Variables in correlators Predefined correlation rules

Page top