Skip to main content

Responses are generated using AI and may contain mistakes.

Correlation RulesCorrelation Rules Guide

Edit a Correlation Rule

Edit a correlation rule you created.

There are two ways to edit correlation rules: using Exabeam Nova Rule Creator or manually.

Edit a Correlation Rule Using Exabeam Nova Rule Creator

Send natural language prompts to Exabeam Nova Rule Creator describing the changes you want to make to the correlation rule. Exabeam Nova Rule Creator drafts the changes, which you can review before saving.

  1. On the Rules tab, select a rule to edit:

    • Click on a rule, then click Edit.

      correlationrules-editrule.png

    • For the rule you're editing, click the More menu The more menu; three vertical grey dots on a white background., then select Edit.

  2. Next to Exabeam Nova can help you edit or update rules, click Edit.

  3. In Describe the rule you want to create, enter a natural language description of the change you want to make.

  4. To send the description to Exabeam Nova Rule Creator, click A blue square with a white outline of a paper airplane in the center.. Exabeam Nova Rule Creator validates whether your description meets correlation rule field requirements, then generates a draft of the correlation rule.

  5. Review the correlation rule draft. To continue tuning the correlation rule, continue prompting Exabeam Nova Rule Creator with the changes you want to see in the correlation rule.

    You can also ask Exabeam Nova Rule Creator other questions about correlation rules; for example, what a group-by field, granular suppression, or correlation rule evaluation delay is.

  6. To save the changes, click Create Rule.

Manually Edit a Correlation Rule

Make changes to a correlation rule using the point-and-click Manual Rule Creator.

  1. On the Rules tab, select a rule to edit:

    • Click on a rule, then click Edit.

      correlationrules-editrule.png

    • For the rule you're editing, click the More menu The more menu; three vertical grey dots on a white background., then select Edit.

  2. Make your changes to the correlation rule.

  3. Review your changes, then click Save.