NetIQ Documentation: NetIQ Sentinel User Guide - Viewing Correlated Events

4.9 Viewing Correlated Events

Correlated events contain detailed information about the trigger events. To view correlated events using the Correlation interface, perform the following:

Launch the Correlation interface.

For more information, see Section 4.2, Accessing the Correlation User Interface.
In the Correlation panel, select any rule, then click .

The events that match the rule criteria are displayed in the search results panel. The correlated events are displayed with the icon.

The default correlated events display the rule name and description as the event name and message respectively. For custom correlated events, you can customize the event name and message by adding the correlation rule name, description, ID, and the rule as parameters in the Send E-mail and Generate Custom Correlation Event actions. For more information, see the specific plug-in documentation.
(Optional) Click View triggers to view the events that generated the correlated event.

You can set the description of the correlated event message field to display the description of the events that triggered the correlated event.
1. Add the following property in the $ESEC_CONFIG_HOME/config/configuration.properties file:
```
sentinel.correlation.eventformat=7.1
```
2. Restart the Sentinel server.

To view the event field values for a correlated event:

In the Sentinel Web Console, expand Filters > My filters, click Correlation Events, click .
In the search results, click All next to the correlated event.

The following table describes the various event fields in a correlated event:

Correlation Event Field	ID	Sample Value	Description
EventName	evt	LoginUser	The name of the correlation rule.
EventTime	dt	2014-02-10T05:21:29.047Z	The time when the last trigger event was fired.
Message	msg	Rule triggered for every successful login	The description in the correlation rule.
ObserverCategory	rv32	SIEM	For a correlated event, this event field is always set to SIEM.
ObserverServiceComponent	rv150	SessionServices	This value is same as that of the last trigger event.
ObserverTZ	estz	Asia/Kolkata	The time zone in which the correlation engine is located.
ObserverType	st	C	For a correlated event, the event field is always set to C.
SentinelProcessingComponent	rt2	LoginUser	The correlation rule name.
SentinelProcessingComponentID	rv123	CC72FBA4-711D-1031-8046-005056A56C5B	This is the ID of the correlation rule. The correlation rule ID remains the same even though the correlation rule name changes.
SentinelServiceComponentName	sres	LoginUser	It is the name of the correlation rule.
SentinelServiceName	res	Correlation	For a correlated event, this event field is always set to Correlation.
Severity	sev	4	For a correlated event, this event field is always set to 4.
XDASClass	xdasclass	2	This value is same as that of the last trigger event.
XDASDetail	xdasdetail	0	This value is same as that of the last trigger event.
XDASIdentifier	xdasid	0	This value is same as that of the last trigger event.
XDASOutcome	xdasoutcome	0	This value is same as that of the last trigger event.
XDASOutcomeName	xdasoutcomename	XDAS_OUT_SUCCESS	This value is same as that of the last trigger event.
XDASProvider	xdasprov	0	This value is same as that of the last trigger event.
XDASRegistry	xdasreg	0	This value is same as that of the last trigger event.
XDASTaxonomyName	xdastaxname	XDAS_AE_CREATE_SESSION	This value is same as that of the last trigger event.

For more information on correlated event fields, click Tips in the Sentinel Web Console. For more information on the event taxonomy and event fields, see Sentinel Taxonomy.

You can use the event field IDs to create search queries to find specific correlated events. For example, if you want to search for the correlated events that were generated because of the correlation rule LoginUser, specify the following query in the Search field:

st:C AND rt2:LoginUser

For more information about searching for events, see Section 2.1, Running an Event Search.