trigger correlation rule for past event occurance

[rashid47010]

there was one event occured yesterday and we have one correlation rules against that. unfortunatley it was not triggered.
I fix it and update the correlation rule.

is that possible to trigger against past event ?

[richgalloway · Accepted solution]

You would have to modify the correlation search to use a time window that includes the past event. After it triggers, modify the CS again to restore the original time window.