logo
CYBERQUEST Documentation
Correlation
Initializing search
    • Home
      • Introduction
      • Get Started
      • Access Web Interface
      • First Steps
      • Licensing
      • Set-up
      • Installation
      • Distributed Architecture
      • Upgrades
      • Data Sources
      • Introduction
      • Tag based Parsing
      • Supported DataSources
      • Operating Systems
      • Networking
      • Applications
      • Databases
      • Threat Intelligence
      • MetaData
      • Vulnerability Scanner
      • Data Deduplication
      • Web Interface
      • Introduction
      • Using Searches
      • Dashboards Module
      • Reports Module
      • Investigations Module
      • Browser
      • Alerts Module
      • Ueba Module
      • Performance Module
      • Executed Schedules
      • Case Management
      • User Actions
      • Threat Intelligence
      • Overview
      • Providers
      • Built in Automatic Alerts
      • Correlation
      • Introduction of Correlation
      • Types of Correlation
      • Managing Correlation Alerts
      • Default Correlation Alerts
      • Vulnerabilities
      • Overview
      • Vulnerability Reports
      • Vulnerabilities dashboards in CYBERQUEST
      • Settings
      • Application Settings
      • Alerts
      • Data flow rules and filters
      • User and Group Management
      • Management
      • Jobs
      • Tools
      • How to Import and Export Extenstions
      • CYBERQUEST API
      • Collectors
      • Communications
      • DataSources
      • Internals
      • Parsers
      • Utilities
      • Automatic Lookback on Events
      • Support
      • Frequently Asked Questions
      • Additional utilities
      • Troubleshooting
      • Maintenance
      • Product Support Lifecycle
      • Editions
      • On prem
      • CYBERQUEST Licensing and Versioning
      • CQ in practice
      • Operational
      • Alerts create logon config
      • Back-up CQ
      • Disaster Recovery
      • CQ EventIDs
          • AD information needed to read AD objects
          • Collecting Mysql-data
          • How to Setup Windows Sysmon
          • How to collect in a table from a PostgreSQL database
          • How to collect logs from AWS CloudFront
          • How to collect logs from AWS CloudTrail
          • How to collect logs from Squid
          • How to configure Apache to send logs to CYBERQUEST server
          • How to configure CYBERQUEST to collect MS exchange tracking logs
          • How to configure DarkTrace to send logs to CYBERQUEST server
          • How to configure Firewall CheckPoint to send logs to CQ Server IP Address on port 5140 UDP
          • How to configure FortiGate to send logs to CQ Server IP Address on port 5140 UDP
          • How to configure GravityZone to send logs to CQ Server IP Address on port 5140 UDP
          • How to configure IPS FireEye to send logs to CQ Server IP Address on port 5140 UDP
          • How to configure Linux server to send logs to CQ Server IP Address on port 5140 UDP
          • How to configure Linux server to read custom log files with rsyslog
          • How to configure NGNIX to send logs to CQ Server
          • How to configure NetGear AP to send logs to CQ Server IP Address on port 5140 UDP
          • How to configure ODBC client to collect from Oracle DB instances
          • How to configure Office365 to send logs to CQ Server
          • How to configure VmWare VCSA 6.7 to send logs to CQ Server IP Address on port 5140 UDP
          • How to configure WSO2 to send logs to CYBERQUEST server IP Address on port 5140 UDP
          • How to enable MariaDB auditing
          • How to enable PostgreSQL auditing
          • How to enable Print Service audit
          • How to enable or disable MS SQL Audit for MSSQL instance
          • How to enable the Audit service for Linux
          • How to integrate HR system in CYBERQUEST
          • How to setup Windows Print Logs
          • How to track changes made in Active Directory
          • OSSEC Configuration
          • How to Add a New Asset
          • How to activate automatic Actions in Realtime Alerts
          • How to avoid split brain in MariaDB galera replication
          • How to change CYBERQUEST passwords
          • How to change web application superadmin password
          • How to collect data from Check Point Firewall
          • How to collect data from the Office365 application
          • How to collect data on Active Directory Assets Information
          • How to collect data on Active Directory
          • How to collect data on Windows Application Log
          • How to collect data on Windows Security Log
          • How to collect data on Windows System Log
          • How to connect to CQ Threat Intelligence
          • How to connect to Active Directory
          • How to create Backups
          • How to create a Copy job
          • How to create a DTS Alert
          • How to create a MariaDB cluster for CYBERQUEST operation
          • How to create a RTBF job
          • How to create new alerts
          • How to create a new report and how to run
          • How to create a parser
          • How to create an on-demand dashboard
          • How to delete a user specific data
          • How to delete data from Data Storage
          • How to delete events older than 6 months
          • How to disable two-factor authentication (2FA) to an user account
          • How to enable two-factor authentication (2FA) to an user account
          • How to export data from dashgroup
          • How to export data from Reports page
          • How to forward alerts to another host
          • How to forward syslog data
          • How to create a new dashboard, dashgroup and view data
          • How to manage CYBERQUEST data
          • How to manage Ueba
          • How to manage collect CSV Files
          • How to manage collect Oracle audit Logs
          • How to manage credentials
          • How to manually deploy agent and assign data sources
          • How to manually deploy agent for Windows based collections
          • How to monitor administrative privileges use
          • How to monitor cyberquest user activities
          • How to monitor inactive accounts
          • How to reconfigure WMI Settings-Permissions for remote collect
          • How to reconfigure WMI settings for remote collect
          • How to restore data from archive
          • Website certificate import and Email certificate import
          • Minimum WMI Permissions for Local User Account
          • Minimum WMI permissions for Domain User Account
          • Password encoding
          • VMI Permissions
          • VMI Ports
      • Third Party Components
      • Licensing
      • Additional reading
      • Smart Objects
      • CQ Smart Objects
      • Introduction
      • Extending Actions
      • Supported Vendors
      • Troubleshooting
      • Automated Actions
      • CYBERQUEST OS
      • OS Installation
      • OS Configuration
      • OS Upgrade
      • Application Configuration
      • GHID DE INSTALARE SERVER IN MEDIU VMWARE
      • GHIDUL ADMINISTRATORULUI
      • Ghid de depanare
      • Ghid instalare Linux Debian 10.7 pentru solutia CyberQuest
      • Ghid pornire audit fisiere windows
      • GHIDUL UTILIZATORULUI
        • Accesarea interfeței web
        • Arhitectura Distribuita
        • CQ Smart Objects
        • Cofigurarea LDAP
        • Corelarea datelor
        • Cum sa creezi o alerta DTS
        • Cum sa redirectionati alerte catre un alt host
        • Cum se colectează date din Active Directory
        • Cum se creeaza un job de copiere
        • Cum se creează un job RTBF
        • Cum se creează un parser
        • Cum se gestioneaza datele CYBERQUEST
        • Cum se gestionează acreditările
        • Cum se implementează manual agentul pentru colecțiile bazate pe Windows
        • Cum se restaurează datele din arhiva
        • Cum se sterg datele din data storage
        • Cum se transmit datele syslog
        • Cum se șterg evenimentele mai vechi de 6 luni
        • Cum să colectați date din jurnalul aplicației Windows
        • Cum să colectați date din jurnalul de securitate Windows
        • Cum să colectați date din jurnalul de sistem Windows
        • Cum să gestionați colectarea de fișiere CSV
        • Cum să gestionați colectarea jurnalelor de audit Oracle
        • Cum să implementați manual agentul și să atribuiți surse de date
        • Cum să te conectezi la Active Directory
        • Cum să vă conectați la CQ Threat Intelligence
        • Editia - On prem
        • Informații AD necesare pentru citirea obiectelor AD
        • Introducere
        • Licentiere CYBERQUEST
        • Manager de Vulnerabilitati
        • Operational
        • CYBERQUEST API
        • Colectori
        • Comunicații
        • Surse de date
        • Interne
        • Parsere
        • Utilitati
        • Retrospectiva automată a evenimentelor
        • Prezentare generala
        • Furnizori
        • Alerte automate încorporate
        • Instalare
        • Interfata Web
        • Introducere
        • Utilizarea cautarilor
        • Panouri de bord
        • Rapoarte
        • Modulul Alerte
        • Modulul Investigatii
        • Browser
        • Managementul Cazurilor
        • Actiunile utilizatorului
        • Modulul UEBA
        • Modulul de Performanta
        • Setari
        • Setari Aplicatie
        • Alerte
        • Reguli și filtre pentru fluxul de date
        • Gestionarea utilizatorilor si a grupurilor
        • Management
        • Joburi
        • Verificator de câmpuri pe loturi
        • Surse de date
        • Introducere
        • Parsarea bazata pe Tag
        • Surse de date
        • Operating Systems
        • Networking
        • Applications
        • Databases
        • Threat Intelligence
        • MetaData
        • Scanner de Vulnerabilitati

    Correlation

    CYBERQUEST Correlation:

    • Introduction of Correlation

    • Types of Correlation

    • Managing Correlation Alerts

    • Default Correlation Alerts

    Copyright 2017-2025 ©Nextgen Software
    Made with Material for MkDocs