Correlation RulesCorrelation Rules Release Notes

Rule Export and Import

To share correlation rules and convert correlation rules to sigma rules, you can now export correlation rules from one environment and import them into another.

Sequence Limit Clarification

It's now clear throughout the Correlation Rules application that there's a limit on the number of sequences you can enable.

Sequence Query Expansion

In the query you use to create a sequence, you can now:

Triggered Correlation Rule Event Enhancements

When a correlation rule triggers, Correlation Rules creates an event that you can then search for in the Search application. Fields were added to, removed from, renamed, and reorganized in these events.

The rules field was added to triggered correlation rule events. It contains an array of triggered rule properties.

Fields moved under the rule field include:

The url field was renamed event_url. The field identifies a URL to the Search application with a query for events associated with the triggered rule.

Fields removed from triggered correlation rule events include:

Webhook Outcome Enhancements

For correlation rules that trigger on first match, you can now clearly identify the event that triggered the rule in the webhook outcome. The related_event field now contains the raw log of the event that triggered the rule.

Unordered Sequences

You can now detect more complicated threats where behaviours occur around the same time, but not one after another. All sequences and their conditions can be satisfied in any order for the rule to trigger.

Event or Field Absence Detection

You can now identify whether you've stopped receiving a specific log, which may indicate there are issues with collecting or ingesting data from a specific machine. Detect missing events, fields, or values that were previously present using the Less Than term in condition statements.

When you detect missing events, fields, or values, you can also use context tables in the sequence query to identify events or fields of interest.

Improved Email Notification Outcome

You can now make more informed choices using the email notification outcome. Email notifications now detail the triggered rule sequences, common properties, and overall rule threshold.