synoti logosynoti logo
Configuration & Implementation Advanced Features

Advanced Features

Elevate your detection and parsing capabilities with sophisticated correlation and expression language features.

CEL Expressions

The where Within rules and filters, field relies on a tailored implementation of the Common Expression Language (CEL). A complete inventory of supported functional overloads is available in the CEL Overloads page.

Example: Multi-Condition Detection

where: >
  exists("origin.ip") && 
  !inCIDR("origin.ip", "10.0.0.0/8") && 
  (startsWith("origin.user", "admin_") || equals("origin.user", "root"))

Nested Correlation (correlation)

Rules can correlate across multiple indices and time windows using correlation.

Multiple Conditions

You can check for multiple distinct event patterns:

correlation:
  - indexPattern: "v1-7-22-log-*"
    count: 5
    within: "now-1h"
    with:
      - { field: "action", operator: "filter_term", value: "failure" }
  - indexPattern: "v1-7-22-log-*"
    count: 1
    within: "now-5m"
    with:
      - { field: "action", operator: "filter_term", value: "success" }

OR Logic in Correlation

Use the or field within correlation to match either of two conditions:

correlation:
  - indexPattern: "v1-7-22-log-*"
    within: "now-12h"
    count: 1
    or:
      - indexPattern: "v1-7-22-alert-*"
        within: "now-24h"
        count: 2

Multi-Stage Filter Pipelines

Filters can go beyond one pass. You can establish several stages for the same dataType to handle complex multi-step parsing:

pipeline:
  - dataTypes: [syslog]
    steps:
      - grok:
          source: raw
          patterns:
            - fieldName: log.message
              pattern: '{{.greedy}}'
  - dataTypes: [syslog]
    steps:
      - json:
          source: log.message

With this modular approach, you can reuse shared parsing logic for various log variants.