correlation_rules

6 rows

✎ View and edit SQL

This data as json, CSV (advanced)

id ▼ name event_a_source_glob event_a_category event_a_action_glob event_b_source_glob event_b_category event_b_action_glob same_actor max_seconds severity summary_template enabled created_at
1 bc_login_to_perm_grant bc:account login % bc:account permission changed 1 300 warning BC chain: actor {actor} logged in, then granted permission within {seconds}s 1 2026-05-21 07:04:52
2 bc_perm_grant_to_app_install bc:account permission changed bc:account app installed 1 600 warning BC chain: actor {actor} was granted permission, then installed app within {seconds}s 1 2026-05-21 07:04:52
3 ss_new_user_then_url_change shipstation:state_detector   %new_user% shipstation:state_detector   %external_url% 0 600 critical ShipStation: new user followed by store URL change within {seconds}s 1 2026-05-21 07:04:52
4 dsm_authfail_then_advisor dsm:auth   %fail% dsm:advisor:summary     0 1800 warning DSM: auth failure followed by Security Advisor severity update within {seconds}s 1 2026-05-21 07:04:52
5 ct_unauthorized_then_cf_state cloudflare:ct_logs     cloudflare:state_diff     0 3600 critical CT log entry followed by Cloudflare config change within {seconds}s 1 2026-05-21 07:04:52
6 bc_perm_change_then_app_remove bc:account permission changed bc:account app removed 1 1800 info BC chain: actor {actor} changed permission, then removed app within {seconds}s 1 2026-05-21 07:04:52

Advanced export

JSON shape: default, array, newline-delimited, object

CSV options: 

CREATE TABLE correlation_rules (
    id                   INTEGER PRIMARY KEY AUTOINCREMENT,
    name                 TEXT NOT NULL UNIQUE,
    event_a_source_glob  TEXT NOT NULL,    -- LIKE pattern, e.g. 'bc:account'
    event_a_category     TEXT,             -- exact match (NULL = any)
    event_a_action_glob  TEXT,             -- LIKE pattern (NULL = any)
    event_b_source_glob  TEXT NOT NULL,
    event_b_category     TEXT,
    event_b_action_glob  TEXT,
    same_actor           INTEGER NOT NULL DEFAULT 1,
    max_seconds          INTEGER NOT NULL DEFAULT 300,
    severity             TEXT NOT NULL DEFAULT 'warning',
    summary_template     TEXT NOT NULL,
    enabled              INTEGER NOT NULL DEFAULT 1,
    created_at           TEXT NOT NULL DEFAULT (datetime('now'))
);
CREATE INDEX idx_correlation_rules_enabled
    ON correlation_rules(enabled);