Identify what caused the rule to trigger and to tune for false positives.
Verify that you have administrator rights or belong to an access group with policy administration permission.
Verify that correlation data sources exist on Trellix ESM.
Details are always gathered at the time of request. But for rules that use dynamic watchlists or other values that might change often, set the rule to get details immediately after triggering. This reduces the chance that details are unavailable.
From the dashboard, click
.png "GUID-0177D71C-5A80-43D5-9629-5D396CF2895F-low.png")
and select Correlation.Set rules to show details immediately.
On the Trellix ESM console, click the Policy editor icon, then click Correlation in the Rule Types pane.
Click the Details column for the rule and select On.
You can select more than one rule at a time.
View the details:
On the system navigation tree, click Rule Correlation under the Trellix ESM - ACE device.
From the view list, select → , then click the event you want to view.
Click the Correlation Details tab to view the details.
On the Event Analysis view, click the plus sign (+) in the first column next to the correlation event.
Note
A plus sign appears only if the correlation event has source events.