Use cases

Every scheduled correlation search found in this deployment, with its health, firing history and owner. Reports and lookup-building searches are left out.

Filter by state, save a view, or group by owner.

Open a use case to see everything about it:

Overview	Alerts, alerts a day, when it last fired, average run time, schedule and search window
SPL	The search, with each part explained
AI review	Chuka reads the search and says whether it does what its name claims
Firing	When it fires by day and hour, and who causes the alerts
Dependencies	The logs, data models, macros and lookups it needs
Tests	Dry runs, replays and attack simulations
History	Every change made to it through Vyrux

A broken use case. The field src_user stopped arriving, and five rules share this cause.

AI review: Chuka says the rule is sound but has no data, and how sure it is.

Firing: when the rule fires, and the accounts behind most alerts.

Dependencies: from log to data model to use case to technique.