Correlation rule builder

A correlation rule builder comprising:

• an object chooser panel displayed via a graphical user interface, the object chooser panel comprising a plurality of alert events;
• an expression object menu bar displayed via the graphical user interface, the expression object menu bar comprising a plurality of relational terms;
• and
• an expression panel displayed via the graphical user interface;
• wherein the expression panel comprises an action box and a correlation box including a left field and an operator icon;
• and
• wherein the graphical user interface is configured to enable a user to construct correlation rules by dragging and dropping alert events from the object chooser panel to the left field of the correlation box and by dragging and dropping actions from the object chooser panel to the expression panel.

A machine readable medium comprising machine readable instructions for causing a computer to perform a method for constructing a correlation rule, the method comprising:

• displaying a graphical user interface comprising an expression panel, an object chooser panel, and an expression object menu bar,
• wherein the expression panel comprises an action box and a correlation box including a left field and an operator icon;
• enabling a user to select one or more alert events by dragging and dropping the selected alert event(s) from the object chooser panel to the left field of the correlation box;
• enabling a user to select an operator by clicking on the operator icon of the correlation box;
• enabling a user to select one or more actions to be performed by the correlation rule by dragging and dropping the selected action(s) from the object chooser panel to the action box of the expression panel.