In which two locations can correlation rules be monitored for errors? (Choose two.)

The correct answer is A. XDR Collector audit logs (type = Rules, subtype = Error) B. correlations_auditing dataset through XQL. Correlation rule errors can be tracked in XDR Collector audit logs (type = Rules, subtype = Error) and by querying the correlations_auditing dataset through XQL. These provide visibility into execution issues and failures for correlation rules.

Monitoring and Investigation

Question

Options

AXDR Collector audit logs (type = Rules, subtype = Error)
Bcorrelations_auditing dataset through XQL
CManagement audit logs (type = Rules, subtype = Error)
DAlerts table as a health alert

How the community answered

(49 responses)

A
94% (46)
C
4% (2)
D
2% (1)

Explanation

Correlation rule errors can be tracked in XDR Collector audit logs (type = Rules, subtype = Error) and by querying the correlations_auditing dataset through XQL. These provide visibility into execution issues and failures for correlation rules.

Topics

#correlation rules#error monitoring#audit logs#correlations_auditing XQL

Community Discussion

No community discussion yet for this question.

Full XSIAM-ENGINEER Practice