---
title: "list correlation rules"
method: GET
path: "/correlation-rules"
tags: ["correlation rule"]
---

# list correlation rules

`GET /correlation-rules`

## Query parameters

- `cursor` string — the pagination token
- `limit` integer — the maximum results to return
- `name-contains` string — Substring search by name (case-insensitive)
- `state` 'enabled' | 'disabled' — Only include rules in the given state
- `severity` string[] — Only include rules with one of the given severities
- `tag` string[] — Only include rules with one of the given tags (case-insensitive)
- `created-by` string — Only include rules whose creator matches this user ID or actor ID
- `last-modified-by` string — Only include rules last modified by this user ID or actor ID

## Response `200`

OK response.

- CorrelationRuleAPIListCorrelationRuleResp
  - `next` string — pagination token for the next page of results
  - `results` CorrelationRuleAPICorrelationRule[]
    - `correlationRuleReferenceIds` string[] — The IDs of the rules referenced by this correlation rule
    - `createAlert` boolean — Determines whether the rule should create alerts when it triggers
    - `createdAt` string
    - `createdBy` object — The actor who created the rule
      - `id` 'user' | 'api-token' | 'system'
      - `type` string
    - `createdByExternal` string — The text of the user-provided CreatedBy field when uploaded via CI/CD
    - `dedupPeriodMinutes` integer — The amount of time in minutes for grouping alerts
    - `description` string — The description of the correlation rule
    - `detection` string, required — The yaml representation of the correlation rule
    - `displayName` string — The display name of the correlation rule
    - `enabled` boolean — Determines whether or not the correlation rule is active
    - `id` string, required — The id of the correlation rule
    - `lastModified` string
    - `lastModifiedBy` object — The actor who last modified the rule
      - `id` 'user' | 'api-token' | 'system'
      - `type` string
    - `logTypes` string[] — The log types derived from the correlation rule references
    - `managed` boolean — Determines if the correlation rule is managed by panther
    - `outputIDs` string[] — Destination IDs that override default alert routing based on severity
    - `reference` string — A URL or note for additional reference material
    - `reports` object — reports
    - `runbook` string — How to handle the generated alert
    - `severity` 'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL'
    - `summaryAttributes` string[] — A list of fields in the event to create top 5 summaries for
    - `tags` string[] — The tags for the correlation rule
    - `tests` CorrelationRuleAPICorrelationRuleUnitTest[] — Unit tests for the correlation rule
      - `expectedResult` boolean, required — Whether the correlation rule should trigger
      - `name` string, required — The name of the test case
      - `ruleOutputs` CorrelationRuleAPICorrelationRuleTestOutput[], required — Simulated rule outputs for the test
        - `id` string, required — The sequence/group ID from the correlation rule
        - `matches` object — Match field to match value to event times
    - `threshold` integer — the number of events that must match before an alert is triggered

---

[API](https://skmtc.dev/panther/apis/panther-rest-api.md) · [All operations](https://skmtc.dev/panther/apis/panther-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/panther/panther-rest-api/revisions/eb177cb9d6a1/schema)