Working enabling correlation rules via automation script code is there a code call that returns the status of a correlation rule either enabled or disabled?
Charlie Sampson Answered question 30th January 2025
Hi Charlie,
You can use the GetCorrelationRuleMessage for this:
var msg = new GetCorrelationRuleMessage()
{
RuleName = "Correlation rule"
};
var resp = engine.SendSLNetSingleResponseMessage(msg) as GetCorrelationRuleResponse;
var isEnabled = resp?.Definition.IsEnabled;
Pieter Carlu [SLC] [DevOps Advocate] Answered question 30th January 2025