Set correlation rules

task brazil Updated Sep 10, 2026 1 min read select-correlation-rules-cs-ng-siem.md

After creating a CrowdStrike Next-Gen SIEM detection profile, select correlation rules to map corresponding detections to a security incident. Correlation rules are refreshed every time a profile is opened and new rules are available for selection. The CrowdStrike Next-Gen SIEM integration supports multiple profiles.

Before you begin

Role required: sn_si.ingestion_profile_admin

Note: Users with the sn_si.admin role can perform all operations available to a profile admin because the sn_si.admin role inherits the required permissions by default.

Procedure

If you are not continuing from the previous section of the detection profile definition process, access the profile you are defining.
1. Navigate to All > CrowdStrike Next-Gen SIEM > Detection Profile.
2. Select the profile you are continuing to define.
3. Select Correlation Rules in the progress bar.
Clear the All Correlation Rules selected check box.
In the Correlation Rule List search field, enter the correlation rule name created in the CrowdStrike portal.
Select the correlation rule.
Use the right arrow to move the rule from Available to the Selected column.
Complete this section of the detection profile definition process by selecting Continue.

What to do next

Map individual CrowdStrike Next-Gen SIEM detection fields to the fields on the ServiceNow AI Platform Security Incident Response security incident. For more information, see Map detection fields.

50 lines · 2.5 KB Wrap lines

---
title: Set correlation rules
description: After creating a CrowdStrike Next-Gen SIEM detection profile, select correlation rules to map corresponding detections to a security incident. Correlation rules are refreshed every time a profile is opened and new rules are available for selection. The CrowdStrike Next-Gen SIEM integration supports multiple profiles.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/select-correlation-rules-cs-ng-siem.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [CrowdStrike Next-Gen SIEM integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Set correlation rules

## Before you begin

Role required: sn\_si.ingestion\_profile\_admin

**Note:** Users with the sn\_si.admin role can perform all operations available to a profile admin because the sn\_si.admin role inherits the required permissions by default.

## Procedure

1. If you are not continuing from the previous section of the detection profile definition process, access the profile you are defining.

1. Navigate to **All** &gt; **CrowdStrike Next-Gen SIEM** &gt; **Detection Profile**.

2. Select the profile you are continuing to define.

3. Select **Correlation Rules** in the progress bar.

2. Clear the **All Correlation Rules selected** check box.

3. In the Correlation Rule List search field, enter the correlation rule name created in the CrowdStrike portal.

4. Select the correlation rule.

5. Use the right arrow to move the rule from **Available** to the **Selected** column.

6. Complete this section of the detection profile definition process by selecting **Continue**.

## What to do next

Map individual CrowdStrike Next-Gen SIEM detection fields to the fields on the ServiceNow AI Platform Security Incident Response security incident. For more information, see [Map detection fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/map-crowdstrike-next-gen-inc.md).