Threat Detection ManagementThreat Detection Management Guide

In Threat Detection Management, navigate to the Correlation Rules tab, then select a correlation rule to edit:

• Click on a correlation rule, then click Edit.

  

• For the correlation rule you're editing, click the More menu , then select Edit.

Next to Exabeam Nova can help you edit or update rules, click Edit.

In Describe the rule you want to create, enter a natural language description of the change you want to make.

To send the description to Exabeam Nova Rule Creator, click . Exabeam Nova Rule Creator validates whether your description meets correlation rule field requirements, then generates a draft of the correlation rule.

Review the correlation rule draft. To continue tuning the correlation rule, continue prompting Exabeam Nova Rule Creator with the changes you want to see in the correlation rule.

You can also ask Exabeam Nova Rule Creator other questions about correlation rules; for example, what a group-by field, granular suppression, or correlation rule evaluation delay is.

To save the changes, click Create Rule.

In Threat Detection Management, navigate to the Correlation Rules tab, then select a correlation rule to edit:

• Click on a correlation rule, then click Edit.

  

• For the correlation rule you're editing, click the More menu , then select Edit.

Make your changes to the correlation rule.

Review your changes, then click Save.