Changing configuration in ES App Correlation Rules

[garima_chauhan]

Hi,

I want to change the Alert condition of the correlation rules in ES APP. I am using ES App v 2.4.1 and Splunk v 5.0.5. If I open the correlation rule through Enterprise Security>>Configure>>Correlation Searches, I do not get many options like Alert condition, Expiration Time. However, these fileds are accesible if I open the same correaltion rule from core splunk>>Manager>>Searches and Reports. But, when I make any changes to these paramters through core splunk manager, the changes do not reflect even though it shows me "the search has been updated" message. I want the alert condition to be in accordance with the "No of events" option. Also I want to remove throttling since I have scheduled all the correlation rules in the ES APP and hence throttling isn't required. I am not sure how this can be done.

Please help and correct me if I am wrong in my understanding of this.
Thanks in anticipation.

[garima_chauhan]

Hi,
The alert configuration changes do not get reflected on the console but the changes are applied and refect in the savedsearches.conf of each category of correlation rules, viz Access Protection, Endpoint and so on. Also, if changes are required to be reflected on the console, uncheck the "summary indexing" option which is displayed when these rules are opened through Manager>>Searches and Reports. I am not sure as to what impact will the unchecking have, but since I have scheduled most of these searches to run over short time periods, I am hoping that unchecking summary indexing will not impact my environment.