Various threat intelligence feeds inform the correlation rules defined by SIEM users; products evaluate threat intelligence feeds differently and allow users to add their own.