Skip to main content

Correlation RulesCorrelation Rules Guide

Import Correlation Rules

After you export correlation rules, import them into another environment.

  1. On the Rules tab, click Import rules A partial rounded blue square from which emerges an arrow curving downwards and to the left, both of which are set inside a blue square..

  2. Click Select File, then select a JSON file containing no more than 50 rules and no larger than 4 MB. Correlation Rules validates the correlation rules in the file to ensure you're not importing duplicate correlation rules that already exist in your environment.

    If a rule you're importing has the same name as an existing rule in your environment, you must remove the rule from the import job. To remove the correlation from being imported, click threatcenter-settings-delete.png for the correlation rule.

  3. After the correlation rules are validated, click Import Rules.

    Imported correlation rules are automatically disabled. The correlation rule author is the account that imported the rule. The correlation rule Created time is the date and time the rule was imported.