- Get Started with Correlation Rules
- Create Correlation Rules
- Create a Correlation Rule Using the Exabeam Nova Rule Creator
- Create a Correlation Rule from Scratch Using the Manual Rule Creator
- Create a Correlation Rule from a Template
- Create a Correlation Rule from Search
- Group by Field in Correlation Rules
- Detect Absent Events or Fields Using Correlation Rules
- Granular Suppression
- Correlation Rule Evaluation Delay
- Manage Correlation Rules
- Find Correlation Rules
- Share Correlation Rules
- View Correlation Rules Metrics
PrevNext
Test a Correlation Rule
To test a correlation rule and ensure it works as you expect, enable the rule in test mode.
In test mode, the rule triggers but the outcomes you specified are suppressed. An event with activity type rule-trigger-test is created. Threat Center doesn't create an alert. The rule status is changed to Testing.