Skip to main content
Glama
CoveoSec
by CoveoSec

correlations_get

Retrieve correlation rules from Cortex XSIAM with optional filters for fields like name, severity, and status. Use extended view for full rule details.

Instructions

Get Correlation Rules

Return a list of correlation rules. You can return all correlation rules or filter results. You can also return extended results with all details included.

  • The response is concatenated using AND condition (OR is not supported).

  • The maximum result set size is >100.

  • Offset is the zero-based number of incidents from the start of the result set.

You must have Instance Administrator permissions to run this endpoint.

[POST /public_api/v1/correlations/get] · Correlation Rules

Example request body:

{
  "request_data": {
    "extended_view": false
  }
}

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
request_dataYes
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses the AND-only filtering condition, the maximum result set size (>100), zero-based offset semantics, and the Instance Administrator permission requirement. These are meaningful behavioral traits beyond what annotations provide, though it could also mention response structure or side-effect safety (though 'get' implies read-only).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately concise, with a clear structure: summary, bullet points for key traps, permission note, and an example. The opening line repeats the tool name, but overall the text is organized and each sentence contributes useful context. It could be tightened by removing the redundant title line.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (nested request_data, filters, pagination, extended_view), the description provides core operational constraints (AND, offset, max size) and a permission requirement, but omits critical parameter syntax details. The example only shows extended_view, not how to construct filters or pagination. The schema fills some gaps, but the description alone is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is reported as 0%, so the description must compensate for parameter understanding. It only gives a high-level mention of 'filter results' and 'extended results' and an example with extended_view. It does not explain the filter fields, operators, or search_from/search_to parameters, which are essential for correct invocation. The example is minimal and does not cover the main use case of filtering.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get Correlation Rules' and 'Return a list of correlation rules,' which identifies a specific verb and resource. It distinguishes from sibling tools like correlations_insert and correlations_delete by focusing on retrieval, and mentions filtering and extended results, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the general use case (list/filter correlation rules) but does not explicitly contrast with alternatives such as correlations_insert or correlations_delete. There is no when-not-to-use guidance or reference to sibling tools, so the agent gets a clear context but no exclusionary information. This is adequate but not rich.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/CoveoSec/xsiam-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server