- Get Started with Correlation Rules
- Create Correlation Rules
- Create a Correlation Rule Using the Exabeam Nova Rule Creator
- Create a Correlation Rule from Scratch Using the Manual Rule Creator
- Create a Correlation Rule from a Template
- Create a Correlation Rule from Search
- Group by Field in Correlation Rules
- Detect Absent Events or Fields Using Correlation Rules
- Granular Suppression
- Correlation Rule Evaluation Delay
- Manage Correlation Rules
- Find Correlation Rules
- Share Correlation Rules
- View Correlation Rules Metrics
Enable or Disable Correlation Rules
Enable rules to activate them or disable rules to deactivate them without deleting them.
On the Rules tab, select rules to enable or disable:
To select all rules, click the checkbox in the header row, then click Enable or Disable.
To select multiple rules, click the checkbox for each rule you're enabling or disabling, then click Enable or Disable.
Click on a single rule, then click Enable or Disable.
For a single rule, click the More menu, then select Enable or Disable.
Click Enable or Disable.
If the rule is configured to be enabled in test mode, its Enabled status is marked with a yellow triangle under the STATUS column.
By default, only 200 sequences can be enabled at any given moment. If the rules you're enabling exceeds this limit, you receive an error and must reduce the number of rules you're enabling.