- Create an AnyObject with at least 2 plain attributes, the name of the AnyObject must be the concatenation of the values of the two attributes separated by a character like '_'. In the second AnyObject the value of the first attribute must contains the value of the first attribute of the first AnyObject.
- Create a pull correlation rule using 2 plain attributes for the created AnyObject and assign that on a resource.
- Pull the AnyObjects from the choosen resource.
- Having a pull correlation rule the created query use a like_regex and during the pull of the first AnyObject both the AnyObjects will match the query generating a remediation.