Enable historical correlation, which reviews the events, applies the filters, and packages the events that apply.
On the system navigation tree, select ACE Properties, then click Historical.
Click Add, fill in the information requested, then click OK.
Select Enable Historical Correlation, then click Apply.
Real-time correlation is discontinued until you disable historical correlation.
Select the filters you want to run, then click Run Now.
After running historical correlation, view the generated events downloaded to Trellix ESM.
On the system navigation tree, select the Trellix ESM - ACE device on which you just ran historical correlation.
On the time period drop-down list, select the period you specified when setting up the run.