Documentation Center
AlienVault® USM Anywhere™

Correlation Lists

Role Availability Read-Only Analyst Manager

USM Anywhere enables you to create correlation lists. Use a correlation list to group values together to apply to a single rule. So instead of creating a rule for each value, you can save time and effort by creating a correlation list and using it in a rule.

When creating correlation lists for rules, you can use a standard field, such as event_name or event_description. A helpful use for correlation lists is the creation of user blacklist, whitelists, or both, like event_names. Or you can enter anything you want in the items of the correlation lists, but only up to 100 characters per item.

To see an example of an alarm rule using a correlation list, see Example: Creating an Alarm Rule Using a Correlation List.

To create a correlation list

  1. Go to Settings > Rules.
  2. On the left navigation panel, click Correlation Lists.
  3. Correlation Lists main window

  4. Click New List.
  5. New Correlation List popup window

  6. Enter a name for the correlation list in the Name field and, if desired, a description to clarify its use in the Description field.
  7. Important: The valid characters for the correlation list name are uppercase letters (A–Z), lowercase letters (a–z), numerical digits (0–9), and underscore (_). You can enter up to 64 characters.

  8. Click Add Item to include items to your list.
  9. Click Save.

To add a new item to a list

  1. Go to Settings > Rules.
  2. On the left navigation panel, click Correlation Lists.
  3. Click the list to which you want to add a new item, and click Add Item.
  4. Add new item to your list

    The Add Item popup window displays.

  5. Enter the value and click Save.

To modify a correlation list

  1. Go to Settings > Rules.
  2. On the left navigation panel, click Correlation Lists.
  3. Click the icon of the list you want to modify.
  4. Edit icon in the main correlation lists page

  5. Modify the data of the items that need to be modified.
  6. Click Save.

To delete a correlation list

  1. Go to Settings > Rules.
  2. On the left navigation panel, Click Correlation Lists.
  3. Click the icon of the list you want to delete.
  4. Delete Icon in the Correlation Lists main page

  5. Click Delete.

To modify an item of a list

  1. Go to Settings > Rules.
  2. On the left navigation panel, click Correlation Lists.
  3. Click the list of the item that want to modify, and click the icon.
  4. Modify an item inside a list

  5. Modify the item and click the icon.

To delete an item of a list

  1. Go to Settings > Rules.
  2. On the left navigation panel, click Correlation Lists.
  3. Click the list of the item that want to delete, and click the icon.