correlations_insert
Create new or overwrite existing correlation rules to configure detection queries, alerting, and automated response in XSIAM.
Instructions
Insert or update Correlation Rules
Insert new Correlation Rules or update existing Correlation Rules.
Note: The Correlation Rule id is tenant specific and can't be used across tenants. Inserting Correlation Rules with the same id as an existing Correlation Rule on that tenant will overwrite the existing Correlation Rule.
You must have Instance Administrator permissions to run this endpoint.
[POST /public_api/v1/correlations/insert] · Correlation Rules
Example request body:
{
"request_data": [
{
"id": 28,
"name": "Test",
"severity": "SEV_030_MEDIUM",
"xql_query": "dataset = xdr_data | fields event_type, action_process_username, uuid, action_boot_time | comp values(*) as * by action_process_username\n",
"is_enabled": "ENABLED",
"description": "RTESRTESTestret",
"alert_name": "Test",
"alert_category": "DISCOVERY",
"alert_description": "Test",
"alert_fields": {},
"execution_mode": "REAL_TIME",
"search_window": "1 hours",
"simple_schedule": "10 minutes",
"timezone": "Asia/Jerusalem",
"crontab": "*/10 * * * *",
"suppression_enabled": true,
"suppression_duration": "1 hours",
"suppression_fields": [
"event_type"
],
"dataset": "alerts",
"mitre_defs": {
"TA0005 - Defense Evasion": [
"T1014 - Rootkit"
]
},
"investigation_query_link": "dataset = xdr_data | fields event_type, action_process_username, uuid, action_boot_time | comp values(*) as * by action_process_username",
"drilldown_query_timeframe": "ALERT",
"mapping_strategy": "AUTO"
}
]
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes |