[Yandex Cloud documentation](../../../index.md) > [Yandex SIEM](../../index.md) > [Step-by-step guides](../index.md) > [Correlation rules](index.md) > Working with a list of rules

# Working with a list of correlation rules

{% note info %}

This feature is in the [Preview](../../../overview/concepts/launch-stages.md) stage. To get access, contact [tech support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

This section describes how to view a list of correlation rules, apply filters, and manage rule deployment.

## Getting started {#before-you-begin}

The Yandex SIEM section will appear in the Cloud Center interface as a Security Deck module after the access request is approved.

You need the `ycem.editor` [role](../../../iam/roles-reference.md#ycdr-admin) to use the service.

## Viewing a list of rules {#list}

To view a list of correlation rules:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.

  You will see a list of all available rules and their statuses. Click a column header to sort the list by that column.

{% endlist %}

## Rule filtering {#filter}

To filter correlation rules based on specific criteria:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. Use filters above the list:
     * **Status**: Filter rules by status: **Healthy**, **Unhealthy**, or **Inactive**.
     * **Type**: Filter by type: **Preset** or **Custom**.
     * **Category**: Filter by threat category.
     * **Severity**: Filter by trigger severity level.

  The list will refresh to show only rules that match the selected criteria.

{% endlist %}

## Staging a rule for deployment {#mark-for-deploy}

To apply changes to a rule, stage it for deployment:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. In the rule's row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Mark for deployment**.

  The rule deployment status will switch to **Will be deployed**. Once deployment is complete, the status will change to **Deployed**.

{% endlist %}

## Canceling rule deployment {#cancel-deploy}

To cancel a scheduled rule deployment:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to **Correlation rules**.
  1. In the rule's row, click ![image](../../../_assets/console-icons/ellipsis.svg) and select **Do not deploy**.

  The rule deployment status will switch back to **Changed**.

{% endlist %}

#### Useful links {#see-also}

* [Correlation rules and exceptions](../../concepts/correlation-rules.md)
* [Managing correlation rules](manage-rules.md)
* [Managing exceptions](../exceptions/manage-exceptions.md)