Use this search to audit your correlation searches. It includes various information like who is the author of the correlation search, who modified it, etc.
In addition to that, the search also gives you an brief info on whether the correlation search has been triggered in past 30 days or not considering it has notable as an action item.
| multisearch[ search index=_internal sourcetype=splunkd_ui_access splunkd servicesNS saved searches method=POST| regex uri="/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/[^/ ]*$"| rex field=uri "/[^/]*/splunkd/__raw/servicesNS/[^/]*/[^/]*/saved/searches/(?<search_encoded>[^/\? ]*)"| eval Title=urldecode(search_encoded)| rename user as "Last Modified By"| eval "Last Modified Time"=strftime(_time,"%b %d, %I:%M %p")| fields Title "Last Modified By" "Last Modified Time"][ search earliest=-30d@d latest=@d index=notable| search eventtype!=notable_suppression*| rename search_name as Title| eval isNotable = 1| fields isNotable Title| fields - _raw] | append[| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches| where match('action.correlationsearch', "1|[Tt]|[Tt][Rr][Uu][Ee]") OR match('action.notable', "1|[Tt]|[Tt][Rr][Uu][Ee]")| where disabled=0| eval Enabled=if(disabled=0,"Yes","No")| rename action.correlationsearch.enabled as enabled, action.notable.param.rule_description as Description, title as Title , author as Author| fields Title Enabled Author] | stats values(*) as * sum(isNotable) as notableCount by Title | eval "Triggered in past 30 days"=if(notableCount>0,notableCount,"No") | search Author=* | streamstats count as Number | lookup update=true correlationsearches_lookup _key as Title OUTPUTNEW rule_name as "Rule Name" | table Number Title "Rule Name" Enabled Author "Last Modified By" "Last Modified Time" "Triggered in past 30 days"
