Where is the correlation_id value used?

[randytangco]

Hello..   I have been trying to understand where is the correlation_id field is used in the security operations application when managing an incoming security event.

OOB, I think the SIEM (Splunk) sends a snsecevent message to SN.   I get to see the correlation_id field in the additional field of the event table.

However, I am not able to find in the system where is that used for managing the creation of alerts for de-duplication purposes.     Is there a place to check how it is used?

[sachin_namjoshi]

Hi Randy,

Check for business rules, script includes, client scripts, UI scripts....

Regards,

Sachin

[randytangco]

sachin.chinchkar.   Thank you for the input.   I had done the search of the business rules, script includes, et al and did not find the source code that uses the field.   I event change the search keyword for message_key and did not find anything.   I know it is there though.