how can i create a web phishing attack correlation rule?

dear all

how can i use the "referer" filed in fortiweb for creating the correlation rule in arcsight ESM.

if you have any suggestion other than fortiweb referer fileds please share it.

BR

Amir