Correlation Configuration

In correlation configuration section, in general configuration tab; if the users define the declare time, the users can specify the reservation time for the log in the correlation memory. If the system detects the bigger reservation time in any rule, the reservation time is automatically is set to the bigger one.

If we define the rule priority; this is a default value for any rule. If the users set rule priority value less than 100 for a rule, the priority is given for the operation of that work.

If we mention about time restriction, There are default time zones, which can be used in the correlation rules. Here, you can also set your own specific time zone through Add Time Restriction tab.

To add Time Restriction:

1. Select Settings
2. Select Correlation Configuration
3. Select Time Restriction
4. Select Add Time Restriction
5. Enter the configurations shown in the figure below:

1. The users can use new Time Restriction in Correlation rule configuration as shown in the figure below:

If we mention about define list, the users can define specific lists, which can be used later on in the correlation. For example, the users can create a blacklisted IP group and then the users can add blacklisted IPs in this group. The users can later on use the blacklisted IP group in the correlation.

To add a Define List:

• • 1. Select Settings
    2. Select Correlation Configuration
    3. Select Define List
    4. Select Add Define List button
    5. The user can use the define list named blacklist created above in the correlation rule as shown in the figure below: