Example
Show rules with approved status
approvalStatus: APPROVED
Example
Show correlation rules with manual approval type
approvalType: MANUAL
Example
Show rules with manual change type
changeType: MANUAL
createdBy.user.idcreatedBy.user.id
Example
Show rules with this ID
createdBy.user.id: 2384
createdBy.User.namecreatedBy.User.name
Examples
Show rules created by this user
CreatedBy.user.name: user12
Show users with usernames that contain parts of name
CreatedBy.user.name: "user"
Show users with usernames that match exact value
CreatedBy.user.name: `user12`
dispositionCategorydispositionCategory
Example
Show rules in the patching category
dispositionCategory: PATCHING
Example
Show rules with this ID
id: 003b9084-643f-f4af-8336-b2530663a
Examples
Show rules reviewed by this reviewer
reviewers: reviewer476
Show rules with reviewers that contain parts of name
reviewers: "rev23"
Show rules with reviewers that match exact value
reviewers: 'rev23'
Examples
Show correlation rule with this rule name
ruleName: Rule for create action
Show correlation rules that contain parts of name
ruleName: "create action"
Show correlation rules that match exact value
ruleName: 'create action'
Example
Show rules with daily schedule type
scheduleType: DAILY
Example
Show incidents that are open
status: OPEN
Example
Show rules updated with this ID
updatedBy.user.id: 2384
updatedBy.user.nameupdatedBy.user.name
Examples
Show rules updated by the user with username user12
updatedBy.user.name: user12
Show rules updated with username that contain parts of name
updatedBy.user.name: "user"
Show rules updated with username that match exact value
updatedBy.user.name: `user12`
Example
Show approved correlation rules that are in patching category
approvalStatus: APPROVED and dispositionCategory: PATCHING
Example
Show correlation rules that are configured for automatic approval.
not changeType: AUTOMATED
Example
Show correlation rules with one of these categories
dispositionCategory: MALWARE or dispositionCategory: GENERAL_HACKING