Set up correlation rules to compare event fields (for example, compare that the source and destination user are the same). You can also set up a rule that ensures that the source IP address and destination IP address are different.
Note
The values used with the Regex, Does not match regex, Contains, and Does not contain operators can be case sensitive or case insensitive depending on the rules or Default correlation manager settings. For In/Not In operators, only random string watchlists can be evaluated as case-insensitive, based on the Default String Compare setting configured on the correlation manager.
On the Trellix ESM console, click the Policy Editor icon
.png "GUID-D5AACD7D-9544-4011-8E37-D57FED1D7387-low.png")
.In the Rule Types pane, select Correlation, click the rule you want to compare fields in, then click →
Click the menu icon of a logic component
.png "Three_dots_icon.png")
, then click Edit.In the filters area, click Add, or select an existing filter and click Edit.
Click the Default Value Editor icon
.png "GUID-911771E2-BC63-4466-BDB0-4D486C98E7FA-low.png")
, type the value and click Add, then select the field on the Fields tab and click Add.Numeric fields support the following operators: greater than (>), less than (<), greater than or equal to (>=), and less than or equal to (<=).