How to write correlation search to show these alerts?

[m_khatibo88]

Hi Community,

I have these alerts on EDR and I want to create a correlation search to show these alerts on the Splunk

• Found alert GnDump.exe was returned as Malware from the Fidelis Sandbox Submission on endpoint HQ0S-IT-NAS.Jmcc2.local
• Found alert GnScript.exe was returned as Malware from the Fidelis Sandbox Submission on endpoint HQ0S-IT-NAS.Jmcc2.local

[gcusello]

Hi @m_khatibo88 ,

could you share the two (or only one?) searches generating the two alerts?

Then, what do you mean with "correation"? do you want one search where there are both the results or what else?

Ciao.

Giuseppe