This section has the following information about Sentinel™ correlation engine Rule LG language.
Section 3.1, Correlation RuleLG Language Overview
Section 3.2, Event Fields
Section 3.3, Event Operations
Section 3.4, Rule Operations
Section 3.5, Operators
Section 3.6, Order of Operators
Section 3.7, Differences between Correlation in 5.x and 6.x