diff --git a/cypress/integration/1_detectors.spec.js b/cypress/integration/1_detectors.spec.js
index 25a4a4c99..bbf1ecf8d 100644
--- a/cypress/integration/1_detectors.spec.js
+++ b/cypress/integration/1_detectors.spec.js
@@ -16,7 +16,6 @@ const cypressIndexDns = 'cypress-index-dns';
 const cypressIndexWindows = 'cypress-index-windows';
 const detectorName = 'test detector';
 const cypressLogTypeDns = 'dns';
-const sampleNotificationChannel = 'sample_chime_channel';
 const creationFailedMessage = 'Create detector failed.';
 
 const cypressDNSRule = dns_name_rule_data.title;
@@ -43,10 +42,6 @@ const logTypeLabel = 'Log type';
 
 const getLogTypeField = () => cy.getFieldByLabel(logTypeLabel);
 
-const notificationLabel = 'Notification channel';
-
-const getNotificationField = () => cy.getFieldByLabel(notificationLabel);
-
 const openDetectorDetails = (detectorName) => {
   cy.getInputByPlaceholder('Search threat detectors').type(`${detectorName}`).pressEnterKey();
   cy.getElementByText('.euiTableCellContent button', detectorName).click();
@@ -162,8 +157,6 @@ const createDetector = (detectorName, dataSource, expectFailure) => {
     .focus()
     .blur();
 
-  getNotificationField().selectComboboxItem(`[Channel] ${sampleNotificationChannel}`);
-
   cy.intercept('POST', '/_plugins/_security_analytics/mappings').as('createMappingsRequest');
   cy.intercept('POST', '/_plugins/_security_analytics/detectors').as('createDetectorRequest');
 
@@ -227,155 +220,141 @@ describe('Detectors', () => {
 
     cy.createRule(dns_name_rule_data);
     cy.createRule(dns_type_rule_data);
-
-    cy.request('POST', 'http://localhost:9200/_plugins/_notifications/configs/', {
-      config_id: 'sa_notification-channel_id',
-      name: sampleNotificationChannel,
-      config: {
-        name: sampleNotificationChannel,
-        description: 'This is a sample chime channel',
-        config_type: 'chime',
-        is_enabled: true,
-        chime: {
-          url: 'https://sample-chime-webhook',
-        },
-      },
-    }).should('have.property', 'status', 200);
   });
 
-  // describe('...should validate form fields', () => {
-  //   beforeEach(() => {
-  //     cy.intercept('/_plugins/_security_analytics/detectors/_search').as('detectorsSearch');
-
-  //     // Visit Detectors page before any test
-  //     cy.visit(`${OPENSEARCH_DASHBOARDS_URL}/detectors`);
-  //     cy.wait('@detectorsSearch').should('have.property', 'state', 'Complete');
-
-  //     openCreateForm();
-  //   });
-
-  //   it('...should validate name field', () => {
-  //     getNameField().should('be.empty');
-  //     getNameField().focus().blur();
-  //     getNameField().parentsUntil('.euiFormRow__fieldWrapper').siblings().contains('Enter a name.');
-
-  //     getNameField().type('text').focus().blur();
-
-  //     getNameField()
-  //       .parents('.euiFormRow__fieldWrapper')
-  //       .find('.euiFormErrorText')
-  //       .contains(
-  //         'Name should only consist of upper and lowercase letters, numbers 0-9, hyphens, spaces, and underscores. Use between 5 and 50 characters.'
-  //       );
-
-  //     getNameField().type('{selectall}').type('{backspace}').type('tex&').focus().blur();
-
-  //     getNameField()
-  //       .parents('.euiFormRow__fieldWrapper')
-  //       .find('.euiFormErrorText')
-  //       .contains(
-  //         'Name should only consist of upper and lowercase letters, numbers 0-9, hyphens, spaces, and underscores. Use between 5 and 50 characters.'
-  //       );
-
-  //     getNameField()
-  //       .type('{selectall}')
-  //       .type('{backspace}')
-  //       .type('Detector name')
-  //       .focus()
-  //       .blur()
-  //       .parents('.euiFormRow__fieldWrapper')
-  //       .find('.euiFormErrorText')
-  //       .should('not.exist');
-  //   });
-
-  //   it('...should validate description field', () => {
-  //     const longDescriptionText =
-  //       'This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text.';
-
-  //     getDescriptionField().should('be.empty');
-
-  //     getDescriptionField().type(longDescriptionText).focus().blur();
-
-  //     getDescriptionField()
-  //       .parents('.euiFormRow__fieldWrapper')
-  //       .find('.euiFormErrorText')
-  //       .contains(
-  //         'Description should only consist of upper and lowercase letters, numbers 0-9, commas, hyphens, periods, spaces, and underscores. Max limit of 500 characters.'
-  //       );
-
-  //     getDescriptionField()
-  //       .type('{selectall}')
-  //       .type('{backspace}')
-  //       .type('Detector description...')
-  //       .focus()
-  //       .blur();
-
-  //     getDescriptionField()
-  //       .type('{selectall}')
-  //       .type('{backspace}')
-  //       .type('Detector name')
-  //       .focus()
-  //       .blur()
-  //       .parents('.euiFormRow__fieldWrapper')
-  //       .find('.euiFormErrorText')
-  //       .should('not.exist');
-  //   });
-
-  //   it('...should validate data source field', () => {
-  //     getDataSourceField()
-  //       .focus()
-  //       .blur()
-  //       .parentsUntil('.euiFormRow__fieldWrapper')
-  //       .siblings()
-  //       .contains('Select an input source.');
-
-  //     getDataSourceField().selectComboboxItem(cypressIndexDns);
-  //     getDataSourceField()
-  //       .focus()
-  //       .blur()
-  //       .parentsUntil('.euiFormRow__fieldWrapper')
-  //       .find('.euiFormErrorText')
-  //       .should('not.exist');
-  //   });
-
-  //   it('...should validate next button', () => {
-  //     getNextButton().should('be.disabled');
-
-  //     fillDetailsForm(detectorName, cypressIndexDns);
-  //     getNextButton().should('be.enabled');
-  //   });
-
-  //   it('...should validate alerts page', () => {
-  //     fillDetailsForm(detectorName, cypressIndexDns);
-  //     getNextButton().click({ force: true });
-  //     // Open the trigger details accordion
-  //     cy.get('[data-test-subj="trigger-details-btn"]').click({ force: true });
-  //     getTriggerNameField().should('have.value', 'Trigger 1');
-  //     getTriggerNameField()
-  //       .parents('.euiFormRow__fieldWrapper')
-  //       .find('.euiFormErrorText')
-  //       .should('not.exist');
-
-  //     getTriggerNameField().type('{selectall}').type('{backspace}').focus().blur();
-  //     getCreateDetectorButton().should('be.disabled');
-
-  //     cy.getButtonByText('Remove').click({ force: true });
-  //     getCreateDetectorButton().should('be.enabled');
-  //   });
-
-  //   it('...should show mappings warning', () => {
-  //     fillDetailsForm(detectorName, cypressIndexDns);
-
-  //     getDataSourceField().selectComboboxItem(cypressIndexWindows);
-  //     getDataSourceField().focus().blur();
-
-  //     cy.get('[data-test-subj="define-detector-diff-log-types-warning"]')
-  //       .should('be.visible')
-  //       .contains(
-  //         'To avoid issues with field mappings, we recommend creating separate detectors for different log types.'
-  //       );
-  //   });
-  // });
+  describe('...should validate form fields', () => {
+    beforeEach(() => {
+      cy.intercept('/_plugins/_security_analytics/detectors/_search').as('detectorsSearch');
+
+      // Visit Detectors page before any test
+      cy.visit(`${OPENSEARCH_DASHBOARDS_URL}/detectors`);
+      cy.wait('@detectorsSearch').should('have.property', 'state', 'Complete');
+
+      openCreateForm();
+    });
+
+    it('...should validate name field', () => {
+      getNameField().should('be.empty');
+      getNameField().focus().blur();
+      getNameField().parentsUntil('.euiFormRow__fieldWrapper').siblings().contains('Enter a name.');
+
+      getNameField().type('text').focus().blur();
+
+      getNameField()
+        .parents('.euiFormRow__fieldWrapper')
+        .find('.euiFormErrorText')
+        .contains(
+          'Name should only consist of upper and lowercase letters, numbers 0-9, hyphens, spaces, and underscores. Use between 5 and 50 characters.'
+        );
+
+      getNameField().type('{selectall}').type('{backspace}').type('tex&').focus().blur();
+
+      getNameField()
+        .parents('.euiFormRow__fieldWrapper')
+        .find('.euiFormErrorText')
+        .contains(
+          'Name should only consist of upper and lowercase letters, numbers 0-9, hyphens, spaces, and underscores. Use between 5 and 50 characters.'
+        );
+
+      getNameField()
+        .type('{selectall}')
+        .type('{backspace}')
+        .type('Detector name')
+        .focus()
+        .blur()
+        .parents('.euiFormRow__fieldWrapper')
+        .find('.euiFormErrorText')
+        .should('not.exist');
+    });
+
+    it('...should validate description field', () => {
+      const longDescriptionText =
+        'This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text. This is a long text.';
+
+      getDescriptionField().should('be.empty');
+
+      getDescriptionField().type(longDescriptionText).focus().blur();
+
+      getDescriptionField()
+        .parents('.euiFormRow__fieldWrapper')
+        .find('.euiFormErrorText')
+        .contains(
+          'Description should only consist of upper and lowercase letters, numbers 0-9, commas, hyphens, periods, spaces, and underscores. Max limit of 500 characters.'
+        );
+
+      getDescriptionField()
+        .type('{selectall}')
+        .type('{backspace}')
+        .type('Detector description...')
+        .focus()
+        .blur();
+
+      getDescriptionField()
+        .type('{selectall}')
+        .type('{backspace}')
+        .type('Detector name')
+        .focus()
+        .blur()
+        .parents('.euiFormRow__fieldWrapper')
+        .find('.euiFormErrorText')
+        .should('not.exist');
+    });
+
+    it('...should validate data source field', () => {
+      getDataSourceField()
+        .focus()
+        .blur()
+        .parentsUntil('.euiFormRow__fieldWrapper')
+        .siblings()
+        .contains('Select an input source.');
+
+      getDataSourceField().selectComboboxItem(cypressIndexDns);
+      getDataSourceField()
+        .focus()
+        .blur()
+        .parentsUntil('.euiFormRow__fieldWrapper')
+        .find('.euiFormErrorText')
+        .should('not.exist');
+    });
+
+    it('...should validate next button', () => {
+      getNextButton().should('be.disabled');
+
+      fillDetailsForm(detectorName, cypressIndexDns);
+      getNextButton().should('be.enabled');
+    });
+
+    it('...should validate alerts page', () => {
+      fillDetailsForm(detectorName, cypressIndexDns);
+      getNextButton().click({ force: true });
+      // Open the trigger details accordion
+      cy.get('[data-test-subj="trigger-details-btn"]').click({ force: true });
+      getTriggerNameField().should('have.value', 'Trigger 1');
+      getTriggerNameField()
+        .parents('.euiFormRow__fieldWrapper')
+        .find('.euiFormErrorText')
+        .should('not.exist');
+
+      getTriggerNameField().type('{selectall}').type('{backspace}').focus().blur();
+      getCreateDetectorButton().should('be.disabled');
+
+      cy.getButtonByText('Remove').click({ force: true });
+      getCreateDetectorButton().should('be.enabled');
+    });
+
+    it('...should show mappings warning', () => {
+      fillDetailsForm(detectorName, cypressIndexDns);
+
+      getDataSourceField().selectComboboxItem(cypressIndexWindows);
+      getDataSourceField().focus().blur();
+
+      cy.get('[data-test-subj="define-detector-diff-log-types-warning"]')
+        .should('be.visible')
+        .contains(
+          'To avoid issues with field mappings, we recommend creating separate detectors for different log types.'
+        );
+    });
+  });
 
   describe('...validate create detector flow', () => {
     beforeEach(() => {
@@ -521,9 +500,5 @@ describe('Detectors', () => {
 
   after(() => {
     cy.cleanUpTests();
-    cy.request(
-      'DELETE',
-      'http://localhost:9200/_plugins/_notifications/configs/sa_notification-channel_id'
-    );
   });
 });
diff --git a/cypress/integration/2_rules.spec.js b/cypress/integration/2_rules.spec.js
index 18b18f6ca..3e90ed212 100644
--- a/cypress/integration/2_rules.spec.js
+++ b/cypress/integration/2_rules.spec.js
@@ -330,13 +330,20 @@ describe('Rules', () => {
     it('...should validate selection map key field', () => {
       getSelectionPanelByIndex(0).within(() => {
         getMapKeyField().should('be.empty');
-        getMapKeyField().focus().blur();
+        getMapKeyField()
+          .focus()
+          .blur()
+          .parents('.euiFormRow__fieldWrapper')
+          .find('.euiFormErrorText')
+          .should('not.exist');
+
+        getMapKeyField().type('hello@');
         getMapKeyField()
           .parentsUntil('.euiFormRow__fieldWrapper')
           .siblings()
           .contains('Invalid key name');
 
-        getMapKeyField().type('FieldKey');
+        getMapKeyField().focus().type('{selectall}').type('FieldKey');
         getMapKeyField()
           .focus()
           .blur()
@@ -446,7 +453,6 @@ describe('Rules', () => {
       getSelectionPanelByIndex(0).within(() =>
         getMapKeyField().type('{selectall}').type('{backspace}')
       );
-      toastShouldExist();
       getSelectionPanelByIndex(0).within(() => getMapKeyField().type('FieldKey'));
 
       // selection map value field
diff --git a/public/components/ContentPanel/ContentPanel.tsx b/public/components/ContentPanel/ContentPanel.tsx
index 57871bc65..c92ca6acc 100644
--- a/public/components/ContentPanel/ContentPanel.tsx
+++ b/public/components/ContentPanel/ContentPanel.tsx
@@ -38,7 +38,7 @@ const renderSubTitleText = (subTitleText: string | JSX.Element): JSX.Element | n
   return subTitleText;
 };
 
-const ContentPanel: React.SFC<ContentPanelProps> = ({
+const ContentPanel = ({
   title = '',
   titleSize = 'm',
   subTitleText = '',
@@ -48,7 +48,7 @@ const ContentPanel: React.SFC<ContentPanelProps> = ({
   children,
   hideHeaderBorder = false,
   className = '',
-}) => (
+}: ContentPanelProps): JSX.Element => (
   <EuiPanel
     style={{ paddingLeft: '0px', paddingRight: '0px', ...panelStyles }}
     className={className}
diff --git a/public/components/FormFieldHeader/FormFieldHeader.tsx b/public/components/FormFieldHeader/FormFieldHeader.tsx
index 988c3de26..ffc8f3119 100644
--- a/public/components/FormFieldHeader/FormFieldHeader.tsx
+++ b/public/components/FormFieldHeader/FormFieldHeader.tsx
@@ -14,13 +14,13 @@ export interface FormFieldHeaderProps {
   toolTipText?: string;
 }
 
-export const FormFieldHeader: React.FC<FormFieldHeaderProps> = ({
+export const FormFieldHeader = ({
   headerTitle = '',
   optionalField = false,
   toolTipIconType = 'questionInCircle',
   toolTipPosition = 'top',
   toolTipText = '',
-}) => {
+}: FormFieldHeaderProps): JSX.Element => {
   return (
     <EuiText size={'s'}>
       <strong>{headerTitle}</strong>
diff --git a/public/pages/Correlations/containers/CorrelationRuleFormModel.ts b/public/pages/Correlations/containers/CorrelationRuleFormModel.ts
index f244ae4c2..775b07523 100644
--- a/public/pages/Correlations/containers/CorrelationRuleFormModel.ts
+++ b/public/pages/Correlations/containers/CorrelationRuleFormModel.ts
@@ -7,6 +7,7 @@ import { CorrelationRuleModel } from '../../../../types';
 
 export const correlationRuleStateDefaultValue: CorrelationRuleModel = {
   name: '',
+  time_window: 300000,
   queries: [
     {
       logType: '',
@@ -18,6 +19,7 @@ export const correlationRuleStateDefaultValue: CorrelationRuleModel = {
         },
       ],
       index: '',
+      field: '',
     },
     {
       logType: '',
@@ -29,6 +31,7 @@ export const correlationRuleStateDefaultValue: CorrelationRuleModel = {
         },
       ],
       index: '',
+      field: '',
     },
   ],
 };
diff --git a/public/pages/Correlations/containers/CreateCorrelationRule.tsx b/public/pages/Correlations/containers/CreateCorrelationRule.tsx
index 221619d13..f6823a7dc 100644
--- a/public/pages/Correlations/containers/CreateCorrelationRule.tsx
+++ b/public/pages/Correlations/containers/CreateCorrelationRule.tsx
@@ -25,10 +25,15 @@ import {
   EuiButtonIcon,
   EuiToolTip,
   EuiButtonGroup,
-  EuiHorizontalRule,
+  EuiSelect,
+  EuiSelectOption,
+  EuiFieldNumber,
+  EuiCheckableCard,
+  htmlIdGenerator,
 } from '@elastic/eui';
 import { ruleTypes } from '../../Rules/utils/constants';
 import {
+  CorrelationRule,
   CorrelationRuleAction,
   CorrelationRuleModel,
   CorrelationRuleQuery,
@@ -58,6 +63,28 @@ export interface CorrelationOption {
   options?: CorrelationOption[];
 }
 
+const parseTime = (time: number) => {
+  const minutes = Math.floor(time / 60000);
+  const hours = Math.floor(minutes / 60);
+
+  if (hours > 0 && minutes % 60 === 0) {
+    return {
+      interval: hours,
+      unit: 'HOURS',
+    };
+  } else {
+    return {
+      interval: minutes,
+      unit: 'MINUTES',
+    };
+  }
+};
+
+const unitOptions: EuiSelectOption[] = [
+  { value: 'MINUTES', text: 'Minutes' },
+  { value: 'HOURS', text: 'Hours' },
+];
+
 export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
   props: CreateCorrelationRuleProps
 ) => {
@@ -66,48 +93,81 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
   const [logFieldsByIndex, setLogFieldsByIndex] = useState<{
     [index: string]: CorrelationOption[];
   }>({});
-  const validateCorrelationRule = useCallback((rule: CorrelationRuleModel) => {
-    if (!rule.name) {
-      return 'Invalid rule name';
-    }
-
-    let error = '';
-    const invalidQuery = rule.queries.some((query, index) => {
-      const invalidIndex = !query.index;
-      if (invalidIndex) {
-        error = `Invalid index for query ${index + 1}`;
-        return true;
+  const params = useParams<{ ruleId: string }>();
+  const [initialValues, setInitialValues] = useState({
+    ...correlationRuleStateDefaultValue,
+  });
+  const [action, setAction] = useState<CorrelationRuleAction>('Create');
+  const [logTypeOptions, setLogTypeOptions] = useState<any[]>([]);
+  const [period, setPeriod] = useState({ interval: 1, unit: 'MINUTES' });
+  const [dataFilterEnabled, setDataFilterEnabled] = useState(false);
+  const [groupByEnabled, setGroupByEnabled] = useState(false);
+
+  const validateCorrelationRule = useCallback(
+    (rule: CorrelationRuleModel) => {
+      if (!rule.name) {
+        return 'Invalid rule name';
       }
 
-      const invalidlogType = !query.logType;
-      if (invalidlogType) {
-        error = `Invalid log type for query ${index + 1}`;
-        return true;
+      if (
+        Number.isNaN(rule.time_window) ||
+        rule.time_window > 86400000 ||
+        rule.time_window < 60000
+      ) {
+        return 'Invalid time window.';
       }
 
-      return query.conditions.some((cond) => {
-        const invalid = !cond.name || !cond.value;
-        if (invalid) {
-          error = `Invalid fields for query ${index + 1}`;
+      let error = '';
+      const invalidQuery = rule.queries.some((query, index) => {
+        const invalidIndex = !query.index;
+        if (invalidIndex) {
+          error = `Invalid index for query ${index + 1}.`;
+          return true;
+        }
+
+        const invalidlogType = !query.logType;
+        if (invalidlogType) {
+          error = `Invalid log type for query ${index + 1}`;
+          return true;
+        }
+
+        if (!dataFilterEnabled && !groupByEnabled) {
+          error = 'Select at least one query type';
+          return true;
+        }
+
+        const invalidDataFilter =
+          dataFilterEnabled &&
+          query.conditions.some((cond) => {
+            const invalid = !cond.name || !cond.value;
+            if (invalid) {
+              error = `Invalid fields for query ${index + 1}`;
+              return true;
+            }
+
+            return false;
+          });
+
+        if (invalidDataFilter) {
+          return true;
+        }
+
+        if (groupByEnabled && rule.queries.some((q) => !q.field)) {
+          error = 'Select valid field for group by';
           return true;
         }
 
         return false;
       });
-    });
 
-    if (invalidQuery) {
-      return error;
-    }
+      if (invalidQuery) {
+        return error;
+      }
 
-    return undefined;
-  }, []);
-  const params = useParams<{ ruleId: string }>();
-  const [initialValues, setInitialValues] = useState({
-    ...correlationRuleStateDefaultValue,
-  });
-  const [action, setAction] = useState<CorrelationRuleAction>('Create');
-  const [logTypeOptions, setLogTypeOptions] = useState<any[]>([]);
+      return undefined;
+    },
+    [dataFilterEnabled, groupByEnabled]
+  );
 
   useEffect(() => {
     if (props.history.location.state?.rule) {
@@ -133,22 +193,38 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
   }, []);
 
   useEffect(() => {
+    setPeriod(parseTime(initialValues.time_window));
+    setGroupByEnabled(initialValues.queries.some((q) => !!q.field));
+    setDataFilterEnabled(initialValues.queries.some((q) => q.conditions.length > 0));
+
     initialValues.queries.forEach(({ index }) => {
       updateLogFieldsForIndex(index);
     });
   }, [initialValues]);
 
-  const submit = async (values: any) => {
+  const submit = async (values: CorrelationRuleModel) => {
     let error;
     if ((error = validateCorrelationRule(values))) {
       errorNotificationToast(props.notifications, action, 'rule', error);
       return;
     }
 
+    if (!dataFilterEnabled) {
+      values.queries.forEach((query) => {
+        query.conditions = [];
+      });
+    }
+
+    if (!groupByEnabled) {
+      values.queries.forEach((query) => {
+        query.field = '';
+      });
+    }
+
     if (action === 'Edit') {
-      await correlationStore.updateCorrelationRule(values);
+      await correlationStore.updateCorrelationRule(values as CorrelationRule);
     } else {
-      await correlationStore.createCorrelationRule(values);
+      await correlationStore.createCorrelationRule(values as CorrelationRule);
     }
 
     props.history.push(ROUTES.CORRELATION_RULES);
@@ -212,9 +288,70 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
   ) => {
     return (
       <>
+        <EuiTitle size="s">
+          <h5>Query type</h5>
+        </EuiTitle>
+        <EuiSpacer size="s" />
+        <EuiFlexGroup>
+          <EuiFlexItem style={{ maxWidth: 400 }}>
+            <EuiCheckableCard
+              className="eui-fullHeight"
+              id={htmlIdGenerator('corr-rule-filter')()}
+              label={
+                <>
+                  <EuiTitle size="s">
+                    <h4>Data filter</h4>
+                  </EuiTitle>
+                  <EuiText size="s">
+                    <p>
+                      A correlation will be created for the matching findings narrowed down with
+                      data filter.
+                    </p>
+                  </EuiText>
+                </>
+              }
+              checkableType="checkbox"
+              checked={dataFilterEnabled}
+              onChange={() => {
+                setDataFilterEnabled(!dataFilterEnabled);
+              }}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem style={{ maxWidth: 400 }}>
+            <EuiCheckableCard
+              className="eui-fullHeight"
+              id={htmlIdGenerator('corr-rule-group-by')()}
+              label={
+                <>
+                  <EuiTitle size="s">
+                    <h4>Group by field values</h4>
+                  </EuiTitle>
+                  <EuiText size="s">
+                    <p>
+                      A correlation will be created when the values for the field values for each
+                      data source match between the findings.
+                    </p>
+                  </EuiText>
+                </>
+              }
+              checkableType="checkbox"
+              checked={groupByEnabled}
+              onChange={() => {
+                setGroupByEnabled(!groupByEnabled);
+              }}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+        {!dataFilterEnabled && !groupByEnabled && (
+          <EuiText color="danger" size="s">
+            <p>Select at least one query type</p>
+          </EuiText>
+        )}
+        <EuiSpacer size="xl" />
+
         {correlationQueries.map((query, queryIdx) => {
           const fieldOptions = logFieldsByIndex[query.index] || [];
-          const isInvalidInputForQuery = (field: 'logType' | 'index'): boolean => {
+          const isInvalidInputForQuery = (field: 'logType' | 'index' | 'field'): boolean => {
             return (
               !!touchedInputs.queries?.[queryIdx]?.[field] &&
               !!(formikErrors.queries?.[queryIdx] as FormikErrors<CorrelationRuleQuery>)?.[field]
@@ -228,7 +365,7 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
                   id={`query-${queryIdx}`}
                   buttonContent={
                     <EuiTitle size="s">
-                      <p>Query {queryIdx + 1}</p>
+                      <p>Data source {queryIdx + 1}</p>
                     </EuiTitle>
                   }
                   extraAction={
@@ -327,107 +464,95 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
                       }}
                     />
                   </EuiFormRow>
-                  <EuiSpacer size="xl" />
-                  <EuiTitle size="xs">
-                    <h3>Fields</h3>
-                  </EuiTitle>
-                  <EuiSpacer size="m" />
-                  {query.conditions.map((condition, conditionIdx) => {
-                    const fieldNameInput = (
-                      <EuiComboBox
-                        // isInvalid={isInvalidInputForQuery('logType')}
-                        placeholder="Select a field"
-                        data-test-subj={'field_dropdown'}
-                        options={fieldOptions}
-                        singleSelection={{ asPlainText: true }}
-                        onChange={(e) => {
-                          props.handleChange(
-                            `queries[${queryIdx}].conditions[${conditionIdx}].name`
-                          )(e[0]?.value ? e[0].value : '');
-                        }}
-                        onBlur={props.handleBlur(
-                          `queries[${queryIdx}].conditions[${conditionIdx}].name`
-                        )}
-                        selectedOptions={
-                          condition.name ? [{ value: condition.name, label: condition.name }] : []
-                        }
-                        onCreateOption={(e) => {
-                          props.handleChange(
-                            `queries[${queryIdx}].conditions[${conditionIdx}].name`
-                          )(e);
-                        }}
-                        isClearable={true}
-                      />
-                    );
+                  {!dataFilterEnabled && !groupByEnabled && (
+                    <>
+                      <EuiSpacer />
+                      <EuiText color="danger" size="s">
+                        <p>Select at least one query type</p>
+                      </EuiText>
+                    </>
+                  )}
+                  {dataFilterEnabled && (
+                    <>
+                      <EuiSpacer size="l" />
+                      <EuiTitle size="xs">
+                        <h3>Data filter</h3>
+                      </EuiTitle>
+                      <EuiSpacer size="xs" />
+                      {query.conditions.map((condition, conditionIdx) => {
+                        const fieldNameInput = (
+                          <EuiComboBox
+                            placeholder="Select a field"
+                            data-test-subj={'field_dropdown'}
+                            options={fieldOptions}
+                            singleSelection={{ asPlainText: true }}
+                            onChange={(e) => {
+                              props.handleChange(
+                                `queries[${queryIdx}].conditions[${conditionIdx}].name`
+                              )(e[0]?.value ? e[0].value : '');
+                            }}
+                            onBlur={props.handleBlur(
+                              `queries[${queryIdx}].conditions[${conditionIdx}].name`
+                            )}
+                            selectedOptions={
+                              condition.name
+                                ? [{ value: condition.name, label: condition.name }]
+                                : []
+                            }
+                            onCreateOption={(e) => {
+                              props.handleChange(
+                                `queries[${queryIdx}].conditions[${conditionIdx}].name`
+                              )(e);
+                            }}
+                            isClearable={true}
+                          />
+                        );
 
-                    const fieldValueInput = (
-                      <EuiFieldText
-                        // isInvalid={props.touched.name && !!props.errors.name}
-                        placeholder="Enter field value"
-                        data-test-subj={'rule_name_field'}
-                        onChange={(e) => {
-                          props.handleChange(
-                            `queries[${queryIdx}].conditions[${conditionIdx}].value`
-                          )(e);
-                        }}
-                        onBlur={props.handleBlur(
-                          `queries[${queryIdx}].conditions[${conditionIdx}].value`
-                        )}
-                        value={condition.value}
-                      />
-                    );
-
-                    const conditionToggleButtons = [
-                      { id: 'AND', label: 'AND' },
-                      // { id: 'OR', label: 'OR' },
-                    ];
-                    const conditionButtonGroup = (
-                      <EuiButtonGroup
-                        legend=""
-                        options={conditionToggleButtons}
-                        idSelected={condition.condition}
-                        onChange={(e) => {
-                          props.handleChange(
-                            `queries[${queryIdx}].conditions[${conditionIdx}].condition`
-                          )(e);
-                        }}
-                        className={'correlation_rule_field_condition'}
-                      />
-                    );
-
-                    const firstFieldRow = (
-                      <EuiFlexGroup>
-                        <EuiFlexItem grow={false} style={{ minWidth: 200 }}>
-                          <EuiFormRow label={<EuiText size={'s'}>Field</EuiText>}>
-                            {fieldNameInput}
-                          </EuiFormRow>
-                        </EuiFlexItem>
-                        <EuiFlexItem grow={false} style={{ minWidth: 200 }}>
-                          <EuiFormRow label={<EuiText size={'s'}>Field value</EuiText>}>
-                            {fieldValueInput}
-                          </EuiFormRow>
-                        </EuiFlexItem>
-                      </EuiFlexGroup>
-                    );
-
-                    const fieldRowWithCondition = (
-                      <EuiFlexGroup direction="column">
-                        <EuiFlexItem grow={false} style={{ minWidth: 120 }}>
-                          {conditionButtonGroup}
-                        </EuiFlexItem>
-                        <EuiFlexItem>{firstFieldRow}</EuiFlexItem>
-                      </EuiFlexGroup>
-                    );
-
-                    return (
-                      <>
-                        <EuiAccordion
-                          id={`field-${conditionIdx}`}
-                          initialIsOpen={true}
-                          buttonContent={`Field ${conditionIdx + 1}`}
-                          extraAction={
-                            query.conditions.length > 1 ? (
-                              <EuiToolTip title={'Delete field'}>
+                        const fieldValueInput = (
+                          <EuiFieldText
+                            placeholder="Enter field value"
+                            data-test-subj={'rule_name_field'}
+                            onChange={(e) => {
+                              props.handleChange(
+                                `queries[${queryIdx}].conditions[${conditionIdx}].value`
+                              )(e);
+                            }}
+                            onBlur={props.handleBlur(
+                              `queries[${queryIdx}].conditions[${conditionIdx}].value`
+                            )}
+                            value={condition.value}
+                          />
+                        );
+
+                        const conditionToggleButtons = [{ id: 'AND', label: 'AND' }];
+                        const conditionButtonGroup = (
+                          <EuiButtonGroup
+                            legend=""
+                            options={conditionToggleButtons}
+                            idSelected={condition.condition}
+                            onChange={(e) => {
+                              props.handleChange(
+                                `queries[${queryIdx}].conditions[${conditionIdx}].condition`
+                              )(e);
+                            }}
+                            className={'correlation_rule_field_condition'}
+                          />
+                        );
+
+                        const firstFieldRow = (
+                          <EuiFlexGroup alignItems="center">
+                            <EuiFlexItem grow={false} style={{ minWidth: 200 }}>
+                              <EuiFormRow label={<EuiText size={'s'}>Field</EuiText>}>
+                                {fieldNameInput}
+                              </EuiFormRow>
+                            </EuiFlexItem>
+                            <EuiFlexItem grow={false} style={{ minWidth: 200 }}>
+                              <EuiFormRow label={<EuiText size={'s'}>Field value</EuiText>}>
+                                {fieldValueInput}
+                              </EuiFormRow>
+                            </EuiFlexItem>
+                            <EuiFlexItem>
+                              <EuiFormRow label={<p style={{ visibility: 'hidden' }}>_</p>}>
                                 <EuiButtonIcon
                                   iconType={'trash'}
                                   color="danger"
@@ -440,31 +565,80 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
                                     );
                                   }}
                                 />
-                              </EuiToolTip>
-                            ) : null
+                              </EuiFormRow>
+                            </EuiFlexItem>
+                          </EuiFlexGroup>
+                        );
+
+                        const fieldRowWithCondition = (
+                          <EuiFlexGroup direction="column">
+                            <EuiFlexItem grow={false} style={{ minWidth: 120 }}>
+                              {conditionButtonGroup}
+                            </EuiFlexItem>
+                            <EuiFlexItem>{firstFieldRow}</EuiFlexItem>
+                          </EuiFlexGroup>
+                        );
+
+                        return (
+                          <>
+                            <EuiSpacer size="m" />
+                            {conditionIdx === 0 ? firstFieldRow : fieldRowWithCondition}
+                            <EuiSpacer size="l" />
+                          </>
+                        );
+                      })}
+                      <EuiButton
+                        style={{ width: 125 }}
+                        onClick={() => {
+                          props.setFieldValue(`queries[${queryIdx}].conditions`, [
+                            ...query.conditions,
+                            ...correlationRuleStateDefaultValue.queries[0].conditions,
+                          ]);
+                        }}
+                        iconType={'plusInCircle'}
+                      >
+                        Add field
+                      </EuiButton>
+                    </>
+                  )}
+
+                  {groupByEnabled && (
+                    <>
+                      <EuiSpacer />
+                      <EuiTitle size="xs">
+                        <h3>Group by field</h3>
+                      </EuiTitle>
+                      <EuiSpacer size="s" />
+                      <EuiFormRow
+                        label={<EuiText size={'s'}>Field</EuiText>}
+                        isInvalid={isInvalidInputForQuery('field')}
+                        error={
+                          (formikErrors.queries?.[queryIdx] as FormikErrors<CorrelationRuleQuery>)
+                            ?.field
+                        }
+                      >
+                        <EuiComboBox
+                          placeholder="Select a field"
+                          data-test-subj={'field_dropdown'}
+                          options={fieldOptions}
+                          singleSelection={{ asPlainText: true }}
+                          onChange={(e) => {
+                            props.handleChange(`queries[${queryIdx}].field`)(
+                              e[0]?.value ? e[0].value : ''
+                            );
+                          }}
+                          onBlur={props.handleBlur(`queries[${queryIdx}].field`)}
+                          selectedOptions={
+                            query.field ? [{ value: query.field, label: query.field }] : []
                           }
-                          style={{ maxWidth: '500px' }}
-                        >
-                          <EuiSpacer size="m" />
-                          {conditionIdx === 0 ? firstFieldRow : fieldRowWithCondition}
-                          <EuiHorizontalRule />
-                        </EuiAccordion>
-                        <EuiSpacer size="l" />
-                      </>
-                    );
-                  })}
-                  <EuiButton
-                    style={{ width: 125 }}
-                    onClick={() => {
-                      props.setFieldValue(`queries[${queryIdx}].conditions`, [
-                        ...query.conditions,
-                        ...correlationRuleStateDefaultValue.queries[0].conditions,
-                      ]);
-                    }}
-                    iconType={'plusInCircle'}
-                  >
-                    Add field
-                  </EuiButton>
+                          onCreateOption={(e) => {
+                            props.handleChange(`queries[${queryIdx}].field`)(e);
+                          }}
+                          isClearable={true}
+                        />
+                      </EuiFormRow>
+                    </>
+                  )}
                 </EuiAccordion>
               </EuiPanel>
               <EuiSpacer />
@@ -520,6 +694,26 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
             }
           }
 
+          if (
+            Number.isNaN(values.time_window) ||
+            values.time_window > 86400000 ||
+            values.time_window < 60000
+          ) {
+            errors.time_window = 'Invalid time window.';
+          }
+
+          if (groupByEnabled) {
+            values.queries.forEach((query, idx) => {
+              if (!query.field) {
+                if (!errors.queries) {
+                  errors.queries = Array(values.queries.length).fill(null);
+                }
+
+                (errors.queries as Array<{ field: string }>)[idx] = { field: 'Field is required.' };
+              }
+            });
+          }
+
           return errors;
         }}
         onSubmit={(values, { setSubmitting }) => {
@@ -528,7 +722,7 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
         }}
         enableReinitialize={true}
       >
-        {({ values: { name, queries }, touched, errors, ...props }) => {
+        {({ values: { name, queries, time_window }, touched, errors, ...props }) => {
           return (
             <Form>
               <ContentPanel
@@ -559,6 +753,58 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
                   />
                 </EuiFormRow>
                 <EuiSpacer />
+                <EuiFormRow
+                  label={
+                    <>
+                      <EuiText size={'s'}>
+                        <strong>Time window</strong>
+                      </EuiText>
+                      <EuiText size="xs" color="subdued">
+                        <p>The period during which the findings are considered correlated.</p>
+                      </EuiText>
+                    </>
+                  }
+                  isInvalid={!!errors?.time_window}
+                  error={errors.time_window}
+                  helpText={
+                    'A valid time window is between 1 minute and 24 hours. Consider keeping time window to the minimum for more accurate correlations.'
+                  }
+                >
+                  <EuiFlexGroup gutterSize="none">
+                    <EuiFlexItem>
+                      <EuiFieldNumber
+                        isInvalid={!!errors.time_window}
+                        min={1}
+                        max={period.unit === 'HOURS' ? 24 : 1440}
+                        icon={'clock'}
+                        value={period.interval}
+                        onChange={(e) => {
+                          const newInterval = e.target.valueAsNumber;
+                          const newTimeWindow =
+                            newInterval * (period.unit === 'HOURS' ? 3600000 : 60000);
+                          props.setFieldValue('time_window', newTimeWindow);
+                          setPeriod({ ...period, interval: newInterval });
+                        }}
+                        data-test-subj={'detector-schedule-number-select'}
+                        required={true}
+                      />
+                    </EuiFlexItem>
+                    <EuiFlexItem>
+                      <EuiSelect
+                        options={unitOptions}
+                        onChange={(e) => {
+                          const newUnit = e.target.value;
+                          const newTimeWindow =
+                            period.interval * (newUnit === 'HOURS' ? 3600000 : 60000);
+                          props.setFieldValue('time_window', newTimeWindow);
+                          setPeriod({ ...period, unit: newUnit });
+                        }}
+                        value={period.unit}
+                        data-test-subj={'detector-schedule-unit-select'}
+                      />
+                    </EuiFlexItem>
+                  </EuiFlexGroup>
+                </EuiFormRow>
               </ContentPanel>
               <EuiSpacer size="l" />
               <ContentPanel
@@ -567,6 +813,7 @@ export const CreateCorrelationRule: React.FC<CreateCorrelationRuleProps> = (
                   'Configure two or more queries to set the conditions for correlating findings.'
                 }
                 panelStyles={{ paddingLeft: 10, paddingRight: 10 }}
+                hideHeaderBorder
               >
                 {createForm(queries, touched, errors, props)}
               </ContentPanel>
diff --git a/public/pages/CreateDetector/components/ConfigureAlerts/components/AlertCondition/AlertConditionPanel.tsx b/public/pages/CreateDetector/components/ConfigureAlerts/components/AlertCondition/AlertConditionPanel.tsx
index 6b79cc1ab..a14a8e8f1 100644
--- a/public/pages/CreateDetector/components/ConfigureAlerts/components/AlertCondition/AlertConditionPanel.tsx
+++ b/public/pages/CreateDetector/components/ConfigureAlerts/components/AlertCondition/AlertConditionPanel.tsx
@@ -56,7 +56,6 @@ interface AlertConditionPanelState {
   showNotificationDetails: boolean;
   detectionRulesTriggerEnabled: boolean;
   threatIntelTriggerEnabled: boolean;
-  notificationError: string;
 }
 
 export default class AlertConditionPanel extends Component<
@@ -73,7 +72,6 @@ export default class AlertConditionPanel extends Component<
       showNotificationDetails: true,
       detectionRulesTriggerEnabled: props.alertCondition.detection_types.includes('rules'),
       threatIntelTriggerEnabled: props.alertCondition.detection_types.includes('threat_intel'),
-      notificationError: '',
     };
   }
 
@@ -214,7 +212,6 @@ export default class AlertConditionPanel extends Component<
     const actions = alertCondition.actions;
     if (selectedOptions.length > 0) {
       actions[0].destination_id = selectedOptions[0].value!;
-      this.setState({ notificationError: '' });
     } else {
       actions[0].destination_id = '';
     }
@@ -294,7 +291,6 @@ export default class AlertConditionPanel extends Component<
       showNotificationDetails,
       detectionRulesTriggerEnabled,
       threatIntelTriggerEnabled,
-      notificationError,
     } = this.state;
     const { name, sev_levels: ruleSeverityLevels, tags, severity } = alertCondition;
     const uniqueTagsOptions = new Set(
@@ -540,7 +536,7 @@ export default class AlertConditionPanel extends Component<
 
             <EuiSpacer size={'l'} />
 
-            <EuiFlexGroup alignItems={notificationError ? 'center' : 'flexEnd'}>
+            <EuiFlexGroup alignItems={'flexEnd'}>
               <EuiFlexItem style={{ maxWidth: 400 }}>
                 <EuiFormRow
                   label={
@@ -548,8 +544,6 @@ export default class AlertConditionPanel extends Component<
                       <p>Notification channel</p>
                     </EuiText>
                   }
-                  isInvalid={!!notificationError}
-                  error={notificationError}
                 >
                   <EuiComboBox
                     placeholder={'Select notification channel.'}
@@ -562,13 +556,6 @@ export default class AlertConditionPanel extends Component<
                     onChange={this.onNotificationChannelsChange}
                     singleSelection={{ asPlainText: true }}
                     onFocus={refreshNotificationChannels}
-                    onBlur={(_e) => {
-                      this.setState({
-                        notificationError: selectedNotificationChannelOption.length
-                          ? ''
-                          : 'Notification channel is required',
-                      });
-                    }}
                     isDisabled={!hasNotificationPlugin}
                   />
                 </EuiFormRow>
diff --git a/public/pages/CreateDetector/components/ConfigureAlerts/components/AlertCondition/__snapshots__/AlertConditionPanel.test.tsx.snap b/public/pages/CreateDetector/components/ConfigureAlerts/components/AlertCondition/__snapshots__/AlertConditionPanel.test.tsx.snap
index 159047a20..03b992412 100644
--- a/public/pages/CreateDetector/components/ConfigureAlerts/components/AlertCondition/__snapshots__/AlertConditionPanel.test.tsx.snap
+++ b/public/pages/CreateDetector/components/ConfigureAlerts/components/AlertCondition/__snapshots__/AlertConditionPanel.test.tsx.snap
@@ -570,7 +570,6 @@ Object {
                 class="euiFormRow__labelWrapper"
               >
                 <label
-                  aria-invalid="false"
                   class="euiFormLabel euiFormRow__label"
                   for="some_html_id"
                 >
@@ -1402,7 +1401,6 @@ Object {
               class="euiFormRow__labelWrapper"
             >
               <label
-                aria-invalid="false"
                 class="euiFormLabel euiFormRow__label"
                 for="some_html_id"
               >
diff --git a/public/pages/CreateDetector/components/ConfigureAlerts/containers/ConfigureAlerts.tsx b/public/pages/CreateDetector/components/ConfigureAlerts/containers/ConfigureAlerts.tsx
index 4ec013d21..5f36a817e 100644
--- a/public/pages/CreateDetector/components/ConfigureAlerts/containers/ConfigureAlerts.tsx
+++ b/public/pages/CreateDetector/components/ConfigureAlerts/containers/ConfigureAlerts.tsx
@@ -60,9 +60,7 @@ const isTriggerValid = (triggers: AlertCondition[], hasNotificationPlugin: boole
         !!trigger.name &&
         validateName(trigger.name) &&
         trigger.severity &&
-        trigger.detection_types.length &&
-        (!hasNotificationPlugin ||
-          (hasNotificationPlugin && trigger.actions.every((action) => !!action.destination_id)))
+        trigger.detection_types.length
       );
     })
   );
diff --git a/public/pages/Rules/components/RuleEditor/DetectionVisualEditor.tsx b/public/pages/Rules/components/RuleEditor/DetectionVisualEditor.tsx
index 9ea8b145a..84390d5fe 100644
--- a/public/pages/Rules/components/RuleEditor/DetectionVisualEditor.tsx
+++ b/public/pages/Rules/components/RuleEditor/DetectionVisualEditor.tsx
@@ -61,7 +61,7 @@ interface DetectionVisualEditorState {
 interface SelectionData {
   field: string;
   modifier?: string;
-  values: string[];
+  values: (string | number)[];
   selectedRadioId?: string;
 }
 
@@ -179,16 +179,36 @@ export class DetectionVisualEditor extends React.Component<
       const selectionDataEntries: SelectionData[] = [];
 
       if (Array.isArray(selectionMapJSON)) {
-        selectionDataEntries.push({
-          field: '',
-          modifier: 'all',
-          values: selectionMapJSON,
-          selectedRadioId: `${
-            selectionMapJSON.length <= 1
-              ? SelectionMapValueRadioId.VALUE
-              : SelectionMapValueRadioId.LIST
-          }-${selectionIdx}-0`,
-        });
+        if (selectionMapJSON.length > 0 && typeof selectionMapJSON[0] === 'object') {
+          selectionMapJSON.forEach((map) => {
+            Object.keys(map).forEach((fieldKey, dataIdx) => {
+              const [field, modifier] = fieldKey.split('|');
+              const val = map[fieldKey];
+              const values: any[] = Array.isArray(val) ? val : [val];
+              selectionDataEntries.push({
+                field,
+                modifier,
+                values,
+                selectedRadioId: `${
+                  values.length <= 1
+                    ? SelectionMapValueRadioId.VALUE
+                    : SelectionMapValueRadioId.LIST
+                }-${selectionIdx}-${dataIdx}`,
+              });
+            });
+          });
+        } else {
+          selectionDataEntries.push({
+            field: '',
+            modifier: 'all',
+            values: selectionMapJSON,
+            selectedRadioId: `${
+              selectionMapJSON.length <= 1
+                ? SelectionMapValueRadioId.VALUE
+                : SelectionMapValueRadioId.LIST
+            }-${selectionIdx}-0`,
+          });
+        }
       } else if (typeof selectionMapJSON === 'object') {
         Object.keys(selectionMapJSON).forEach((fieldKey, dataIdx) => {
           const [field, modifier] = fieldKey.split('|');
@@ -203,6 +223,13 @@ export class DetectionVisualEditor extends React.Component<
             }-${selectionIdx}-${dataIdx}`,
           });
         });
+      } else if (typeof selectionMapJSON === 'string' || typeof selectionMapJSON === 'number') {
+        selectionDataEntries.push({
+          field: '',
+          modifier: 'all',
+          values: [selectionMapJSON],
+          selectedRadioId: `${SelectionMapValueRadioId.VALUE}-${selectionIdx}-0`,
+        });
       }
 
       if (selectionDataEntries.length) {
@@ -248,7 +275,7 @@ export class DetectionVisualEditor extends React.Component<
           const fieldName = `field_${selIdx}_${idx}`;
           delete errors.fields[fieldName];
 
-          if (!validateDetectionFieldName(data.field)) {
+          if (data.field && !validateDetectionFieldName(data.field)) {
             errors.fields[fieldName] =
               'Invalid key name. Valid characters are a-z, A-Z, 0-9, hyphens, dots, and underscores';
           }
diff --git a/public/store/CorrelationsStore.ts b/public/store/CorrelationsStore.ts
index c25d764c2..0bd8ebd4e 100644
--- a/public/store/CorrelationsStore.ts
+++ b/public/store/CorrelationsStore.ts
@@ -69,14 +69,28 @@ export class CorrelationsStore implements ICorrelationsStore {
   public async createCorrelationRule(correlationRule: CorrelationRule): Promise<boolean> {
     const response = await this.invalidateCache().service.createCorrelationRule({
       name: correlationRule.name,
-      correlate: correlationRule.queries?.map((query) => ({
-        index: query.index,
-        category: query.logType,
-        query: query.conditions
+      time_window: correlationRule.time_window,
+      correlate: correlationRule.queries?.map((query) => {
+        const queryString = query.conditions
           .map((condition) => `${condition.name}:${condition.value}`)
           // TODO: for the phase one only AND condition is supported, add condition once the correlation engine support is implemented
-          .join(' AND '),
-      })),
+          .join(' AND ');
+
+        const correlationInput: any = {
+          index: query.index,
+          category: query.logType,
+        };
+
+        if (queryString) {
+          correlationInput['query'] = queryString;
+        }
+
+        if (query.field) {
+          correlationInput['field'] = query.field;
+        }
+
+        return correlationInput;
+      }),
     });
 
     if (!response.ok) {
@@ -92,13 +106,27 @@ export class CorrelationsStore implements ICorrelationsStore {
       correlationRule.id,
       {
         name: correlationRule.name,
-        correlate: correlationRule.queries?.map((query) => ({
-          index: query.index,
-          category: query.logType,
-          query: query.conditions
+        time_window: correlationRule.time_window,
+        correlate: correlationRule.queries?.map((query) => {
+          const queryString = query.conditions
             .map((condition) => `${condition.name}:${condition.value}`)
-            .join(' AND '),
-        })),
+            .join(' AND ');
+
+          const correlationInput: any = {
+            index: query.index,
+            category: query.logType,
+          };
+
+          if (queryString) {
+            correlationInput['query'] = queryString;
+          }
+
+          if (query.field) {
+            correlationInput['field'] = query.field;
+          }
+
+          return correlationInput;
+        }),
       }
     );
 
@@ -124,6 +152,7 @@ export class CorrelationsStore implements ICorrelationsStore {
         return {
           index: queryData.index,
           logType: queryData.category,
+          field: queryData.field || '',
           conditions: this.parseRuleQueryString(queryData.query),
         };
       });
@@ -131,6 +160,7 @@ export class CorrelationsStore implements ICorrelationsStore {
       return {
         id: hit._id,
         name: hit._source.name,
+        time_window: hit._source.time_window || 300000,
         queries,
       };
     }
@@ -153,6 +183,7 @@ export class CorrelationsStore implements ICorrelationsStore {
           return {
             index: queryData.index,
             logType: queryData.category,
+            field: queryData.field || '',
             conditions: this.parseRuleQueryString(queryData.query),
           };
         });
@@ -160,6 +191,7 @@ export class CorrelationsStore implements ICorrelationsStore {
         return {
           id: hit._id,
           name: hit._source.name,
+          time_window: hit._source.time_window || 300000,
           queries,
         };
       }));
@@ -295,6 +327,9 @@ export class CorrelationsStore implements ICorrelationsStore {
 
   private parseRuleQueryString(queryString: string): CorrelationFieldCondition[] {
     const queries: CorrelationFieldCondition[] = [];
+    if (!queryString) {
+      return queries;
+    }
     const orConditions = queryString.trim().split(/ OR /gi);
 
     orConditions.forEach((cond, conditionIndex) => {
diff --git a/types/Correlations.ts b/types/Correlations.ts
index 61a94d921..9b93a44a5 100644
--- a/types/Correlations.ts
+++ b/types/Correlations.ts
@@ -37,6 +37,7 @@ export type CorrelationFinding = {
 export interface CorrelationRuleQuery {
   logType: string;
   index: string;
+  field: string;
   conditions: CorrelationFieldCondition[];
 }
 
@@ -48,6 +49,7 @@ export interface CorrelationFieldCondition {
 
 export interface CorrelationRuleModel {
   name: string;
+  time_window: number; // Time in milliseconds
   queries: CorrelationRuleQuery[];
 }
 
@@ -62,11 +64,13 @@ export interface CorrelationRuleTableItem extends CorrelationRule {
 export interface CorrelationRuleSourceQueries {
   index: string;
   query: string;
+  field: string;
   category: string;
 }
 
 export interface CorrelationRuleSource {
   name: string;
+  time_window: number;
   correlate: CorrelationRuleSourceQueries[];
 }