Correlation – Move from old engine to new Correlation module

Solved226 viewsCorrelation Correlation old engine Correlation rules
3
0 Comments

I have some correlation rules that were created a long time ago using the old engine, so their configuration is stored in the SLBrain.xml file.

However, I want to transition to the new Correlation module. Is there a tool available that can simplify this migration, or will I need to do it manually by creating all rules again but using the new module?

Catarina Grilo [SLC] [DevOps Advocate] Selected answer as best 9th August 2024

1 Answer

2
16.30K 0 Comments

Hi Catarina,

As far as I know, there is no migration tool that allows you to migrate old correlation rules to new engine. You will need to manually create the correlation rules.

Catarina Grilo [SLC] [DevOps Advocate] Selected answer as best 9th August 2024