Different functions can be used when creating a new alert rule. Correlation rules can be created with column matching, or the Buckets (lists) you have created can be used.
Let's create a correlation rule.
First, go to Settings > Alerts & Incidents > Alert Rules and click + Alert Rule on the right side of the page.
The Add Alert Rule page opens. In the Definition section, enter the name of the alert in the Description field (only letters, digits, spaces and the characters _ . - / are accepted), then select the Category (required) and the Severity (Emergency, Critical, Warning or Information; the default is Information). Optionally, you can also set Tags, Roles, Notes and a Guide Link.
In the Rule Set section, you can select any column and use functions such as is, is Not, is Exists, Range, Not In Range, Values, NOT Values, Starts With, Ends With, Contains, NOT Contains, Behavior, NOT Behavior, Context, NOT Context, Lower (<), Greater (>), Equal Column and NotEqual Column. Some functions are only enabled for suitable column types (for example, Range for numeric and IP columns, Contains for text columns).
In this example, the IP address column is selected and the "is Not" function is used to exclude the 8.8.8.8 IP address from the rule.
This was the first condition of the correlation. You can continue by adding more conditions. All conditions are combined with an "AND" operator.
In the following conditions, the same source IP is required to be in the "Brute Force Attacker Host" list and also in the "Port Scanner Hosts" list. (These lists include different conditions.)
With the Behavior function you can also select more than one list in a single condition, for example to check whether this IP address is in the "Port Scanner Host" OR "Brute Force Attacker Host" list.
Silence Time: The silence time of the alert, in seconds. The minimum value is 10 and the default is 600.
Silence Columns: The column(s) used for silencing. This field is required.
Mute: Mutes the alert for the given number of hours. Enter the value and click Set Mute Time; the page shows until when the alert is muted.
Run: Determines when the alert runs. Always is the default. When Custom is selected, you can add schedules with Run Days and Run Time. Silence Columns must be selected before you can choose Custom.
White List: Select the white list(s) to be applied to this alert rule.
*Silence: If the same alert rule is triggered more than once with the same value in the silence columns, the alert is not created again until the silence time (in seconds) has passed.
The Action and Notification section contains the following fields.
Action Column: Determines the action column for this alert rule. This field is required.
Action Rules: Select the action rule(s) to run when this alert is triggered. E-mail and SMS notifications, adding values to feed lists and blocking on firewalls are no longer configured in the alert rule; they are defined as action rules under Settings > Alerts & Incidents > Action Rules and selected here.
Overwrite Info: When checked, the Overwrite Column field appears and the alert name is changed to the value of the selected column.
Mitre: Select the MITRE technique(s) for this alert rule.
Soar Connector: Select Alert Engine (default) or Pass Through.
Managed Security: Select the managed security action: Ticket (default), Call or Ticket and Call.
Click Save to create the alert rule.