You can deploy the Correlation rules either from the rule dashboard or from the Correlation Engine dashboard.
To deploy rules from the Correlation Engine dashboard:
Log in to the Sentinel Main interface.
In the navigation panel, click Correlation.
In the Correlation panel, select the rule that you want to deploy and click the Open Overview icon.
In the Deploy/Undeploy section, select the engine to which you want to deploy the rule, then click Deploy.
To deploy rules from the Correlation Rule dashboard:
Log in to the
In the Correlation panel, click the engine to which you want to deploy rules.
The Correlation Engine dashboard is displayed.
In the Available rules section, select the rule or rules that you want to deploy, then click Deploy.