- Get Started with Correlation Rules
- Create Correlation Rules
- Create a Correlation Rule Using the Exabeam Nova Rule Creator
- Create a Correlation Rule from Scratch Using the Manual Rule Creator
- Create a Correlation Rule from a Template
- Create a Correlation Rule from Search
- Group by Field in Correlation Rules
- Detect Absent Events or Fields Using Correlation Rules
- Granular Suppression
- Correlation Rule Evaluation Delay
- Manage Correlation Rules
- Find Correlation Rules
- Share Correlation Rules
- View Correlation Rules Metrics
PrevNext
Clone a Correlation Rule
Clone an existing rule as a starting point for a new correlation rule.
On the Rules tab, select a rule to clone:
Click on a rule, then click Clone.
For the rule you're cloning, click the More menu
, then select Clone.
Name the new rule.
Click Clone. The new rule is created in Disabled status. To customize the rule, edit the rule.