[Yandex Cloud documentation](../../../index.md) > [Yandex SIEM](../../index.md) > [Step-by-step guides](../index.md) > [Correlation rules](index.md) > Managing correlation rules

# Managing correlation rules

{% note info %}

This feature is in the [Preview](../../../overview/concepts/launch-stages.md) stage. To get access, contact [tech support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

This section describes how to create correlation rules, manage their settings, and perform basic operations with them.

## Getting started {#before-you-begin}

The Yandex SIEM section will appear in the Cloud Center interface as a Security Deck module after the access request is approved.

You need the `ycem.editor` [role](../../../iam/roles-reference.md#ycdr-admin) to use the service.

## Creating a correlation rule {#create}

To create a correlation rule:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. Click **New rule**.
  1. In the **Correlation condition** field, enter your KQL query. Use templates, schema, or datasets as needed.
  1. Under **Aggregation**, specify the aggregation key and aggregation window.
  1. Under **Actions on trigger**, configure the new alert by setting its name, type, and classification.
  1. Under **Parameters**, fill in the required **Name** field, and, optionally, **Description**, **Category**, and **Trigger severity**.
  1. Click **Save**.

{% endlist %}

## Editing a rule {#edit}

To change edit a correlation rule:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. In the rule's row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Edit**.
  1. Edit the fields as needed.
  1. Click **Save**.

{% endlist %}

## Disabling a rule {#disable}

To disable a correlation rule:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. In the rule's row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Disable**.

  A disabled rule changes its status to **Inactive** and stops processing events.

{% endlist %}

## Resetting changes {#reset}

To reset the changes you made to the rule to the last deployed version:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. In the rule's row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Reset changes**.

  All unsaved changed will be canceled. The rule will reset to the last deployed configuration.

{% endlist %}

## Deleting a rule {#delete}

You can only delete custom rules. You cannot delete preset rules.

To delete a custom correlation rule:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. In the rule's row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Delete**.
  1. Confirm the deletion.

  {% note warning %}

  Deleting a rule is irreversible. All rule settings will be deleted.

  {% endnote %}

{% endlist %}

#### Useful links {#see-also}

* [Correlation rules and exceptions](../../concepts/correlation-rules.md)
* [Managing exceptions](../exceptions/manage-exceptions.md)
* [Working with a list of correlation rules](rules-list.md)