Question

Solved1.32K views17th July 2023Automation Correlation

1

Ruben Vandepitte [SLC] [DevOps Advocate]2.32K 1st March 2022 0 Comments

Hi,

How can we enable/disable a correlation rule from an automation script?

Preferably this would be done without having to pass the entire configuration of the rule each time.

Thanks!

score 2 · Answer 1 · 2022-03-01T16:10:34+00:00

Hi Ruben,

I believe you'll only be able to do this by sending an UpdateCorrelationRule message to SLNet.

The UpdateCorrelationRule message has a field 'type' that can be set to 'Enable' or 'Disable'

You only need to pass on the rule ID in case of enable or disable messages.

How to enable/disable correlation rule from code?