Understanding the UTMStack Correlation Engine

[jayapradhainfysec]

Initial Alert Triggering:
When a rule is first triggered, the UTMStack correlation engine performs as expected, creating alerts in the threat management system. This is crucial for identifying new or ongoing security threats.

However, in my experience, I've noticed that the alerting behavior changes after the initial trigger. Specifically, the engine only creates alerts the first one or two times a rule is triggered for the same use case. Subsequent triggers do not generate new alerts in the threat management system. So, How actually it works?

[c3s4rfred]

Hi, @jayapradhainfysec, the correlation engine works as you're saying. The rules aren't triggered for the same use case, like: host, user, ip. When the engine process a use case more than one time within 24h, the logs get grouped in the same rule.

Best regards

[jayapradhainfysec]

Any way to edit email template ?

[c3s4rfred]

Hi @jayapradhainfysec the email template is not editable.

Best regards