cancel
Showing results for 
Search instead for 
Did you mean: 
paul.k
Level 10
Report Inappropriate Content
Message 1 of 7

What does the Fields tab in correlation rule do?

Hello, Forgive me if I am missing something in documentation or an existing thread, but what does the Fields tab in the correlation rule do?

I am wracking my brain trying to figure out, but to me is just feels like circular logic. So a field from an event matches another field within it self?

Please help as I am going to drive my self insane trying to figure this out.

Thank You

6 Replies
xded
Level 12
Report Inappropriate Content
Message 2 of 7

Re: What does the Fields tab in correlation rule do?

Hi,

you want to correlate on Host and you have an Event with one Field with the Same or other Information like Host. Than you can correlate this one Event with

Event    Field 1               Field 2               Result

1          Hostname          Hostname          correlate this Event --> Alarm

2          Hostname          IP-Adress           do nothing

etc....

paul.k
Level 10
Report Inappropriate Content
Message 3 of 7

Re: What does the Fields tab in correlation rule do?

Wouldn't Override Group By serve that function?

Or am I missing something?

Thanks

xded
Level 12
Report Inappropriate Content
Message 4 of 7

Re: What does the Fields tab in correlation rule do?

No this wouldn't override the function. The correlation for Fiels is comparing two fields and the group by is grouping more than one event with the same field.

Group by

You have a correlation that correlated ip-address, and Hostname and you group by Source User. now you have 3 Events wit the same Source User and the same Hostname but with 3 different IP-Adresses.

Event    Field 1               Field 2               Result

1          Hostname          Hostname          correlate this Event --> Alarm

2          Hostname          IP-Adress           do nothing

Now you can also group by Source User, all events with the same Source User and will by stacked

paul.k
Level 10
Report Inappropriate Content
Message 5 of 7

Re: What does the Fields tab in correlation rule do?

xded,

Thank you I think this makes a little more sense.

Do you have any correlation rules I can see where this is used?

Thanks.

xded
Level 12
Report Inappropriate Content
Message 6 of 7

Re: What does the Fields tab in correlation rule do?

No sorry i dind't use the feature, but i ask a intel security consultant for this

paul.k
Level 10
Report Inappropriate Content
Message 7 of 7

Re: What does the Fields tab in correlation rule do?

Thanks. Should be interesting.