topic Re: How to retrieve all XQL Correlations in Cortex XSIAM Discussions

How to retrieve all XQL Correlations

WilliamValente — Wed, 13 Mar 2024 18:55:03 GMT

Hi guys, i need a little help.

Is there any dataset that contain all the correlations rules created?

Or can I retrieve all correlations rules via XQL?

I known that I can push this information via API, but unfortunately it is not working here.

Thank you in advance.

Re: How to retrieve all XQL Correlations

afurze — Wed, 13 Mar 2024 18:56:07 GMT

Hi WilliamValente,

There is currently no XQL access to correlation rules.

Re: How to retrieve all XQL Correlations

WilliamValente — Wed, 13 Mar 2024 19:03:17 GMT

Thanks for your answer.

Is there any other option to push this without being via API?

Re: How to retrieve all XQL Correlations

afurze — Wed, 13 Mar 2024 19:12:32 GMT

WilliamValente,

Assuming you are refering to managing correlation rules (and not alerts fired by correlation rules), there is no API for managing those, you can only manage them via the UI.