> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# View and override Correlation Rules

| **Role Availability** | **Read-Only** | **Investigator** | **Analyst** | **Manager** |
| --------------------- | ------------- | ---------------- | ----------- | ----------- |

**To view correlation rules**

1. Go to **Settings > Rules > Correlation Rules**.
2. You can use the search field above the table to search for a rule by entering the search text in the field and then clicking the <img src="https://mintcdn.com/levelblue-5324744e/CMgZi2NlC_uJcr6v/images/usm-anywhere/search-blue.svg?fit=max&auto=format&n=CMgZi2NlC_uJcr6v&q=85&s=d8f0e97fcad12e75cf65ca08be90ddd5" className="inline" width="20" height="20" data-path="images/usm-anywhere/search-blue.svg" /> icon. You can also filter the rules by **Rule Type** (Customized - rules overriden by users or LevelBlue - rules provided by LevelBlue Labs Threat Intelligence) or **Rule Status** (Enabled or Disabled).
3. Click the rule to expand and see the rule details. You can see the strategy, method, and rule itself. You will also see the number of occurrences, length, mute length, and priority assigned to the correlation rule. You can edit the default values. See instructions below for overriding correlation rules.

   <Warning>
     **Important:** Correlation rule details are not visible to users with a trial license.
   </Warning>
4. Click the <img src="https://mintcdn.com/levelblue-5324744e/7_UE4nawuffikKei/images/usm-anywhere/external-link.svg?fit=max&auto=format&n=7_UE4nawuffikKei&q=85&s=4a6d797fd7e9276fbea6a4901fe1e1b9" className="inline" width="20" height="20" data-path="images/usm-anywhere/external-link.svg" /> icon to open the Alarms List view page.

   The page includes Rules Name as a filter so that you can see how many alarms match the selected rule.

   <Note>
     **Note:** The mute length indicates how long the rule is not going to generate an alarm.
   </Note>

**To override correlation rules:**

1. Click **Edit** in the Modifiable Fields section within the correlation rule flyout.
2. Specify the new values for the different fields.

   | **Field**   | **Description**                                                                                                                                             |
   | :---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Occurrences | The number of event occurrences that you want to produce a match on the conditional expression to trigger the rule.                                         |
   | Mute Length | Indicates how long the rule is not going to generate an alarm.                                                                                              |
   | Length      | The timespan that you want to use to identify a match for multiple occurrences.                                                                             |
   | Priority    | See [Priority Fields for Alarms ](https://docs.levelblue.com/documentation/usm-anywhere/user-guide/alarms/alarms-list-priority-field) for more information. |
3. Click **Save**.\
   The correlation rule will be updated, and the rule type will be changed from LevelBlue to Customized.

   <Warning>
     Warning: The default values are tuned by LevelBlue Spider Labs. Changes may impact alert volume, detection fidelity, or system performance. Customized rules can be reverted to their default settings.
   </Warning>