- Get Started with Threat Detection Management
- Analytics Rules
- Analytics Rule Classifications
- Create an Analytics Rule
- Manage Analytics Rules
- Tune Analytics Rules
- Share Analytics Rules
- Troubleshoot Analytics Rules
- Analytics Rules Syntax
- Advanced Analytics Rule Syntax vs. Analytics Rule Syntax
- Logical Expressions in Analytics Rule Syntax
- String Operations Using Analytics Rule Syntax
- Integer Operations Using Analytics Rule Syntax
- Time Operations Using Analytics Rule Syntax
- Network Operations Using Analytics Rule Syntax
- Context Operations Using Analytics Rule Syntax
- Entity Operations Using Analytics Rule Syntax
- Correlation Rule Operations Using Analytics Rule Syntax
- Analytics Engine Status
- Correlation Rules
- Threat Scoring
View Correlation Rules Metrics
Gain insights into and get an overview of your correlation rules.
You can view correlation rules metrics directly in Threat Detection Management or in Dashboards.
Correlation Rules Metrics in Threat Detection Management
In Threat Detection Management, view general insights about your correlation rules that may help you make informed decisions about authoring and tuning correlation rules.
In Available Rules, view the total number of correlation rules in your environment and a pie chart of their statuses.
 |
To view a list of all rules in each status, select the status in the pie chart key. For example, to view a list of all enabled rules, select <#> Enabled in the key.
In Rules Sequence Limit, view the number of created sequences out of the maximum limit of 200 sequences.
 |
in Rule Triggers In last 30 days By Status, view a line chart of the number of correlation rules triggered in enabled and testing statuses over the past 30 days. The green line represents the number of enabled triggered rules. The blue line represents the number of rules triggered in test mode.
 |
To hide the line of enabled triggered rules, click Enabled in the line chart key. To hide the line of rules triggered in test mode, click Testing in the line chart key.
To view more details on the rules triggered on a specific day, hover over the point on the line chart:
 |
To identify the rules triggered on a specific day, hover over the point on the line chart, then click Show Rules. The list of rules filters to show only the rules triggered on that day
Correlation Rules Metrics in Dashboards
In Dashboards, view detailed insights about your correlation rules.
You can use the Correlation Rules Management pre-built dashboard or create your own Dashboards visualizations and dashboards using correlation rule attributes.
When you create a visualization, Correlation Rule attributes are listed under Correlation Rules.