Modify a Built-in Cross-Correlation Rule

Applies to Product: USM Appliance™ LevelBlue OSSIM®

Similar to correlation directives, you can customize cross-correlation rules as well.

Important: Even though the web interface gives an impression that you can cross-correlate events from any data source with those from any other data source, in fact you can only correlate NIDS events with vulnerabilities detected by the LevelBlue Vulnerability Scanner.

To edit an existing cross-correlation rule

  1. Highlight the rule you want to edit and click Modify.
  2. Change any of the four fields as desired.
  3. Click Save Rule.