Configure correlation searches

A correlation search scans multiple data sources for defined patterns. When the search finds a pattern, it performs an adaptive response action such as creating a notable event.

Correlation searches can search many types of data sources, including events from any security domain (access, identity, endpoint, network), asset lists, identity lists, threat intelligence, and other data in Splunk platform. The searches then aggregate the results of an initial search with functions in SPL, and take action in response to events that match the search conditions with an adaptive response action. Configure correlation searches to update the settings associated with how they run.

Enable correlation searches

Enable correlation searches to start running adaptive response actions and receiving notable events. installs with all correlation searches disabled so that you can choose the searches that are most relevant to your use cases.

1. Select Configure > Content Management.
2. Filter on a type of Correlation Search.
3. Locate the name of the correlation search you want to enable.
4. In the Actions column, click Enable to enable the searches that you want to enable.
5. After you enable correlation searches, click "Back to PCI Compliance" in the menu bar.

For details about the correlation searches shipped with the Splunk App for PCI Compliance, see Search View Matrix in the User Manual.

Change correlation search scheduling

Change the default search type of a correlation search from real-time to scheduled. uses indexed real-time searches by default.

1. From the Content Management page, locate the correlation search you want to change.
2. In the Actions column, click Change to scheduled.

Editing correlation searches

You can make changes to correlation searches to fit your environment. For example, modify the thresholds used in the search, change the response actions that result from a successful correlation, or change how often the search runs. Modifying a correlation search does not affect existing notable events.

• Click the name of a correlation search on the Content Management page to edit it.

If you modify the start time and end time for the correlation search, use relative time modifiers. See Specify time modifiers in your search in the Splunk Enterprise Search Manual.

Note: Do not edit correlation searches from the Splunk Settings menu. Editing the search this way can break the correlation search itself, or you might not be able to edit related settings. Correlation searches are more complex than regular searches, and their configuration settings are spread across multiple .conf files.

Edit the correlation search in guided mode

You can edit some correlation searches in guided mode. Not all correlation searches support guided search editing. If a search appears grayed-out and has the option to Edit search manually or Edit search in guided mode, the search was built in guided mode and can be edited in guided mode. If a search can be edited in the search box and only has the option to Edit search in guided mode, editing the search in guided mode overwrites the existing search.

1. Click Edit search in guided mode to open the guided search creation wizard.
2. Review the search elements in the correlation search, making changes if you want.
3. Save the search.

Throttle the number of response actions generated by a correlation search

Set up throttling to limit the number of response actions generated by a correlation search. When a correlation search matches an event, it triggers a response action.

By default, every result returned by the correlation search generates a response action. Typically, you may only want one alert of a certain type. You can use throttling to prevent a correlation search from creating more than one alert. Some response actions allow you to specify a maximum number of results in addition to throttling. See Set up adaptive response actions in .

1. Select Configure > Content Management.
2. Click the title of the correlation search you want to edit.
3. Type a Window duration. During this window, any additional event that matches any of the Fields to group by will not create a new alert. After the window ends, the next matching event will create a new alert and apply the throttle conditions again.
4. Type the Fields to group by to specify which fields to use when matching similar events. If a field listed here matches a generated alert, the correlation search will not create a new alert. You can define multiple fields, and available fields depend on the search fields that the correlation search returns.
5. Save the correlation search.

Throttling applies to any type of correlation search response action and occurs before notable event suppression.

Allow non-admins to edit correlation searches

If you want non-admins to edit correlation searches, add the edit correlation searches capability to a different role in .

1. Select Configure > General > Permissions.
2. Locate the role that you want to allow to edit correlation searches.
3. Select the check box for Edit Correlation Searches for that role.
4. Click Save.