Hi,
the question is , what would you like to correlate? If you want to do a state base correlation for a single event, you can use the normal ruleset. If you want to correlate two ore more different events with each other, you need to write a litte script bases on the EC data. The script must be trigger in the ruleset.
The script need to run “COMMAND UPDATE”,“COMMAND DELETE” and create a new event via mkevent.
Regards, Christian