@vinith97
Yes, but I don't believe it's documented.
Correlation searches are saved searches similar to alerts with the correlationsearch action and various related actions: notable, risk, etc. The actions and their properties are defined in $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/default/alert_actions.conf.
There are various examples of correlation searches in savedsearches.conf in each of the app modules included with Splunk ES.
To reverse engineer the process, you can create a correlation search in the user interface and check savedsearches.conf to see which settings are applied. You can then duplicate the process using the saved/searches API endpoint (see https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches ) and its action parameter. After the search is saved, you can modify action parameters with the saved/searches/{name} endpoint (see https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D ).
If you don't have access to configuration files, you may need to test on a private instance. I don't use Splunk Cloud, and you may need to contact Splunk support to confirm your solution is supported.
