B.0 Correlation Rule Expression Syntax

Correlation rules are written to match specific events or sequences of events by using field references, comparison and match operators on the field contents, and operations on sets of events.

The Correlation Engine loads the rule definition and uses the rules to evaluate, filter, and store events in memory that meet the criteria specified by the rule. Depending on the rule definition, a correlation rule might fire according to several different criteria:

This section provides a basic overview of how to build Correlation rules and the various parameters required to build a rule.