- Get Started with Correlation Rules
- Create Correlation Rules
- Create a Correlation Rule Using the Exabeam Nova Rule Creator
- Create a Correlation Rule from Scratch Using the Manual Rule Creator
- Create a Correlation Rule from a Template
- Create a Correlation Rule from Search
- Group by Field in Correlation Rules
- Detect Absent Events or Fields Using Correlation Rules
- Granular Suppression
- Correlation Rule Evaluation Delay
- Manage Correlation Rules
- Find Correlation Rules
- Share Correlation Rules
- View Correlation Rules Metrics
PrevNext
Manage Correlation Rules
After you create correlation rules, you can clone, delete, edit, enable, disable, or delete them.
Preview Correlation Rule Details
Quickly view a summary of a correlation rule.
Edit a correlation rule you created.
To test a correlation rule and ensure it works as you expect, enable the rule in test mode.
Enable or Disable Correlation Rules
Enable rules to activate them or disable rules to deactivate them without deleting them.
Clone an existing rule as a starting point for a new correlation rule.
Delete multiple correlation rules or a single correlation rule you no longer need.