https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129924#M371 <P>Is there any list available anywhere which contains all the correlation searches and their description together? I would like to present it to some stakeholders, but documentation contains only a few of them. I'm looking for something like the "Search View matrix" in the User Guide of the Splunk Enterprise Security app, but with all the correlation searches in it. </P> <P>Thanks<BR /> Miklos</P> Thu, 28 May 2015 16:08:53 GMT mjuhasz 2015-05-28T16:08:53Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129924#M371 <P>Is there any list available anywhere which contains all the correlation searches and their description together? I would like to present it to some stakeholders, but documentation contains only a few of them. I'm looking for something like the "Search View matrix" in the User Guide of the Splunk Enterprise Security app, but with all the correlation searches in it. </P> <P>Thanks<BR /> Miklos</P> Thu, 28 May 2015 16:08:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129924#M371 mjuhasz 2015-05-28T16:08:53Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129925#M372 <P>Yes. Use a REST search to expose the information in a table with the fields you're interested in. Example: </P> <PRE><CODE>| rest /services/alerts/correlationsearches | rename eai:acl.app as app, title as csearch_name | table app security_domain csearch_name description </CODE></PRE> Thu, 28 May 2015 19:09:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129925#M372 ekost 2015-05-28T19:09:29Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129926#M373 <P>Thank you! Elegant. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 03 Jun 2015 12:53:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129926#M373 mjuhasz 2015-06-03T12:53:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129927#M374 <P>And if you want to include the actual search text, for analysis of what rules use what data sources for example, you can extend this answer to:</P> <PRE><CODE>| rest /services/alerts/correlationsearches | rename eai:acl.app as app, title as csearch_name | join type=outer app csearch_name [ rest /services/saved/searches | rename eai:acl.app as app, title as csearch_name search as csearch | table app csearch_name csearch ] | table app security_domain csearch_name description csearch </CODE></PRE> Wed, 18 May 2016 16:42:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129927#M374 Jason 2016-05-18T16:42:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129928#M375 <P>For ES 4.6 and later, the REST endpoint to call has changed. <BR /> Sample from the <A href="http://docs.splunk.com/Documentation/ES/4.7.0/Admin/Upgradecorrelationsearches">ES admin docs</A>: <CODE>| rest splunk_server=local count=0 /services/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | rename eai:acl.app as app, title as csearch_name, action.correlationsearch.label as csearch_label, action.notable.param.security_domain as security_domain | table csearch_name, csearch_label, app, security_domain, description</CODE></P> Thu, 04 May 2017 14:48:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129928#M375 ekost 2017-05-04T14:48:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129929#M376 <P>Thank you for the update!</P> Fri, 05 May 2017 14:57:11 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129929#M376 mjuhasz 2017-05-05T14:57:11Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129930#M377 <P>Using the search provide in the ES documentation did not list all of the correlation searches in our environment, especially the ones in other apps. I used this search to find them all </P> <P><CODE>| rest /servicesNS/-/-/saved/searches splunk_server=local | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]")</CODE></P> Tue, 16 Jul 2019 13:23:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-a-complete-list-with-descriptions-of-correlation/m-p/129930#M377 martinr8 2019-07-16T13:23:22Z