list_correlation_rules
List and search detection rules by name, data type, or activation state. Filter and retrieve rule details including ID, definition, and category.
Instructions
List/search correlation (detection) rules. search: free text on rule name. data_types: e.g. 'wineventlog' or 'linux'. active: 'true' or 'false' to filter by activation state. Returns id, name, definition (the matching expression), ruleActive, category. server: which configured server to target (default active/default).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| size | No | ||
| active | No | ||
| search | No | ||
| server | No | ||
| data_types | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |