Abstract: A correlation rule builder is disclosed which displays a graphical user interface that enables a user to construct rules, the program causing a computer to perform actions based on the rules. The interface allows a user to construct the rules by dragging-and-dropping objects from an object chooser panel and an expression object menu bar onto an expression panel. The objects include alerts, logical operators for the rules, and actions. A correlation box inside the expression panel allows the user to create expressions which are related by operators such as AND and OR; the correlated expressions must be satisfied for the chosen actions to occur. The rule builder also allows a user to create groups of expressions within the correlation box; the expressions within each group may be related by operators such as AND and OR, and the groups may be related to each other by operators such as AND and OR.