How to enable/disable correlation rule from code?

Solved956 viewsAutomation Correlation
1
0 Comments

Hi,

How can we enable/disable a correlation rule from an automation script?

Preferably this would be done without having to pass the entire configuration of the rule each time.

Thanks!

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 17th July 2023

2 Answers

2
12.55K 0 Comments

Hi Ruben,

I believe you'll only be able to do this by sending an UpdateCorrelationRule message to SLNet.

The UpdateCorrelationRule message has a field 'type' that can be set to 'Enable' or 'Disable'

You only need to pass on the rule ID in case of enable or disable messages.

Ive Herreman [SLC] [DevOps Catalyst] Answered question 1st March 2022
You are viewing 1 out of 2 answers, click here to view all answers.