there was one event occured yesterday and we have one correlation rules against that. unfortunatley it was not triggered.
I fix it and update the correlation rule.
is that possible to trigger against past event ?
You would have to modify the correlation search to use a time window that includes the past event. After it triggers, modify the CS again to restore the original time window.
You would have to modify the correlation search to use a time window that includes the past event. After it triggers, modify the CS again to restore the original time window.