Correlation Rule

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello guys,

I have a problem with my correlation rule. When I link my rule to the source, my aggregation starts giving an error.

Exception occurred in Iterate Objects. Error message - Failed to create any iterator instance for aggregation for application : Azure - Service Principal [source]

The rule is:

There is a field called “spn_tags”, which is a multivalued field. I need to get a value from this list that has exactly 4 letters. If it exists, I return this value as correlation.

image
image726×651 50.6 KB

2

Were you able to troubleshoot this. We also had a similar correlation rule for the AWS connected source. with a MV variable like SP-TAGS. We have to correlate based on one attribute in that source, and its not correlating. How did you troubleshoot these cloud rules?

3

I haven’t been able to solve it yet. I created this topic precisely to have support in troubleshooting hahah.