I recently found this Dojo page describing functionality retirements. I seem to recall that SLBrain.exe was only used for correlation rules using the old/legacy engine. Is this correct? If so, are there any End of Life or End of Engineering plans for SLBrain?
Gellynck Jens [SLC] Selected answer as best 1st October 2021
Hi Jens,
Yes you are correct. New correlation engine actions are handled completely separately.
At the moment we are still providing backwards compatibility with old style correlation rules, so there is no fixed plan to retire SLBrain yet as far as I know.
Simon Raine [SLC] [DevOps Advocate] Edited comment 1st October 2021
In short no. It looks to me like SLBrain has not been fully decoupled from other processes yet. So I would advise against this.
Thanks Simon! So in theory if I don’t use legacy correlation rules, I can disable the SLBrain service without interfering with my system?