report of rules fired with base events
Re: report of rules fired with base events
I am not sure it is possible with a report or a query because the correlated events does not modify base events thus there is no way to correlate these 2 types of events.
With the console when you use detailed chain to see Correlated Event and the base events related to this rule, it uses this query:
Event ID in ("X" ,"Y", ... ) Or Event ID Correlated by ("X" ,"Y", ... )
I think this information is saved into the DB and there is no operator Correlated By that permit you to do it with ESM query/report.
I think, it is just a assumption (not tested yet), that you could do that in query the ESM DB directly with a script.
If ESM can do it in launching detailed chain, there is a table where Event ID is correlated by other Event ID to get the result as opening an Active Channel is the same as launching a query on the ESM DB.
I hope I have helped you.