Creating Correlation Rules

Correlation rules can be defined in the Correlation Rule Wizard by walking through the wizard or by choosing the Custom/Freeform option to write the rule in the proprietary RuleLG language. All rule definitions are stored in the database in RuleLG.

Correlation rules can be defined based on any populated event field.

NOTE:When creating a rule, you can refer to a dynamic list for it. For more information, see Using a Dynamic List in a Correlation Rule.

For trademark and copyright information, see Legal Notices.