How to get a complete list with descriptions of correlation searches in the Splunk Enterprise Security app with sourcetype and severity ?
(A bit off your specific question but perhaps helpful)The use case library - has data dependencies listed for use cases
https://docs.splunk.com/Documentation/ES/6.2.0/Admin/Usecasecontentlibrary
I've never been able to find such a list. The best you can do is a query to show the correlation searches available on your SH. See https://docs.splunk.com/Documentation/ES/6.2.0/Admin/Listcorrelationsearches
