Working enabling correlation rules via automation script code is there a code call that returns the status of a correlation rule either enabled or disabled?
Hi Charlie,
You can use the GetCorrelationRuleMessage for this:
var msg = new GetCorrelationRuleMessage()
{
RuleName = “Correlation rule”
};
var resp = engine.SendSLNetSingleResponseMessage(msg) as GetCorrelationRuleResponse;
var isEnabled = resp?.Definition.IsEnabled;
Hi Charlie,
I believe there is a similar question:
How to enable/disable correlation rule from code?
Hope it helps.
Hi Charlie,
If you have a look at the snippet provided in the answer to the question, you will find the method enableCorrelationRule. This method will retrieve an existing correlation rule. The property IsEnabled will provide you the current status of the correlation rule.
Hope it helps.
The information fully answers my question. Thank you to both Miguel and Pieter for the pointers.
Thank you for the information however I am more after a "rule status" call to find out if enabled or disabled?