Administration Guide › Event Correlation and Incident Management › Correlation Rule Tasks

Correlation Rule Tasks

Correlation rules can report patterns of events, helping you to identify suspicious activities or dangerous conditions in your environment. Each time events match a correlation rule's criteria, CA User Activity Reporting Module creates an incident.

You can perform the following correlation rule tasks if you have the Administrator role:

• Create, edit, or delete a correlation rule
• Create a correlation rule group
• Import or export a correlation rule.
• Apply correlation rules and associate notification destinations in your environment.

This section contains the following topics:

About Correlation Rules

Using Pre-Defined Correlation Rules

Using Keyed Lists with Correlation Rules

Example: Creating a CSV File for Testing

About Incident Notifications

How to Design and Apply Incident Notifications