Skip to main content
Role AvailabilityRead-OnlyInvestigatorAnalystManager
To view correlation rules
  1. Go to Settings > Rules > Correlation Rules.
  2. You can use the search field above the table to search for a rule by entering the search text in the field and then clicking the icon. You can also filter the rules by Rule Type (Customized - rules overriden by users or LevelBlue - rules provided by LevelBlue Labs Threat Intelligence) or Rule Status (Enabled or Disabled).
  3. Click the rule to expand and see the rule details. You can see the strategy, method, and rule itself. You will also see the number of occurrences, length, mute length, and priority assigned to the correlation rule. You can edit the default values. See instructions below for overriding correlation rules.
    Important: Correlation rule details are not visible to users with a trial license.
  4. Click the icon to open the Alarms List view page. The page includes Rules Name as a filter so that you can see how many alarms match the selected rule.
    Note: The mute length indicates how long the rule is not going to generate an alarm.
To override correlation rules:
  1. Click Edit in the Modifiable Fields section within the correlation rule flyout.
  2. Specify the new values for the different fields.
    FieldDescription
    OccurrencesThe number of event occurrences that you want to produce a match on the conditional expression to trigger the rule.
    Mute LengthIndicates how long the rule is not going to generate an alarm.
    LengthThe timespan that you want to use to identify a match for multiple occurrences.
    PrioritySee Priority Fields for Alarms for more information.
  3. Click Save.
    The correlation rule will be updated, and the rule type will be changed from LevelBlue to Customized.
    Warning: The default values are tuned by LevelBlue Spider Labs. Changes may impact alert volume, detection fidelity, or system performance. Customized rules can be reverted to their default settings.