Add correlation rules to help you interpret patterns in the data.
Make sure your system includes an Advanced Correlation Engine (ACE).
From the Trellix ESM dashboard, click and select More Settings .
On the left pane, click + next to the ACE device.
Select Rule Correlation and click
.png "GUID-F191D568-8B93-4D2C-9BFC-F1342FC407BD-low.png")
.The Add Correlation Manager window opens.
Select Enable and Use Event Data and click Finish.
The Correlation Management window opens.
Click Yes.
The Rollout window opens.
Select Rule Correlation under Device and click OK.
To add or edit rules that are enabled click Rule Correlation and go to policy editor.
The correlation rule is added.