Well since no one has an answer I guess I will share my own solution. Seems after much experimentation the best solution I can offer is to end the correlation search with an eval statement and add the rule_title to a new field and expand it myself. This means I now have to have the text in two places and need to keep it in sync and I now need to go through and edit a whole bunch of correlation searches. This seems an obvious short coming in the tool, perhaps someone should fix it. Based on the example above I would add
|eval ticket_title=signature." - IDS watchlist event for ".src
to the end of the search. Then in my workflow action I could add $ticket_title$ instead of $rule_title$ to the post command and I would get the expanded fields. This is stupid but it works and does not require an extra search.
... View more