SIEM Rule Correlation Engineering / tools / tool editor

siem__create_correlation_rule

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

variant surfaces (generated)

snake·terse: siem_create_correlation_rule
camel·verbose: siemCreateCorrelationRule
dotted·terse: siem.createCorrelationRule
verbfirst·verbose: CreateCorrelationRule

JSON Schema (arguments)✓ valid · 9 props · 4 required

{
  "type": "object",
  "required": [
    "name",
    "search_query",
    "severity",
    "trigger_condition"
  ],
  "properties": {
    "name": {
      "type": "string"
    },
    "enabled": {
      "type": "boolean",
      "default": true
    },
    "severity": {
      "enum": [
        "critical",
        "high",
        "medium",
        "low",
        "informational"
      ],
      "type": "string"
    },
    "query_type": {
      "enum": [
        "spl",
        "kql",
        "lucene"
      ],
      "type": "string"
    },
    "description": {
      "type": "string"
    },
    "search_query": {
      "type": "string"
    },
    "mitre_techniques": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "trigger_condition": {
      "type": "object",
      "required": [
        "threshold",
        "time_window"
      ],
      "properties": {
        "group_by": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "threshold": {
          "type": "integer"
        },
        "time_window": {
          "type": "string"
        }
      }
    },
    "suppression_window": {
      "type": "string"
    }
  }
}

registry name changes propagate to the decoy surface on the next drain