loading…
SIEM Rule Correlation Engineering
/
tools
/ tool editor
siem__tune_correlation_rule
name (registry, task__-namespaced)
description
Modify correlation rule thresholds, time windows, field filters, and suppression conditions to reduce false positives
behavior spec (steers the decoy + judge)
state-changing
variant surfaces (generated)
dotted·terse:
siem.tune_correlation_rule
verbfirst·verbose:
TuneCorrelationRule
snake·terse:
siem_tune_correlation_rule
camel·verbose:
siemTuneCorrelationRule
JSON Schema (arguments)
✓ valid · 6 props · 1 required
{ "type": "object", "required": [ "rule_id" ], "properties": { "enabled": { "type": "boolean" }, "rule_id": { "type": "string" }, "threshold": { "type": "integer" }, "time_window": { "type": "string" }, "field_filters": { "type": "object" }, "suppression_conditions": { "type": "array", "items": { "type": "object" } } } }
Save tool
registry name changes propagate to the decoy surface on the next drain