Administration Guide › Event Correlation and Incident Management › Correlation Rule Tasks › About Correlation Rules

About Correlation Rules

You can apply predefined correlation rules, use the correlation rule wizard to create custom correlation rules for your environment, or modify existing rules. Correlation rules allow you to identify groups of events that may indicate attacks or other security risks. You must have the Administrator role to create or edit correlation rules.

When you create a correlation rule, you must select which of the three types to create. The rule template controls what event or events are considered an incident. The following templates are available:

• Simple Filter - allows you to search for a single event or state. This templates creates an incident from a single event.
• Counting Template - allows you to search for a set of identical events. You can control how many events of the same type the rule searches for. Each time the rule detects the number of events you set, it triggers an incident.
• State Transition Template - allows you to search for a related series of events. When one specific event or state occurs, followed by one or more others, the rule creates an incident. You can define the states that the rule searches for, and set the number of states.

Note: Effective correlation requires a full view of incoming events. For this reason you should consider avoiding applying suppression or summarization rules at the agent level. Any events that are suppressed or summarized at the agent are not considered for correlation and incident creation.

Event correlation can result in significant network traffic. For this reason you may wish to consider assigning a dedicated Correlation Server. See the CA Enterprise Log Manager Implemention Guide for more information about server roles.

If there too many incident messages for the correlation service to process, the correlation service maintains a queue of up to 10,000 messages. Any further messages are lost. CA Enterprise Log Manager generates a self-monitoring event if this occurs.

More information:

About Incident Notifications