You can't do it through the GUI.
Assuming this would work, you'd have to manually remove the rules you don't want from the ..\etc\devices\correlation_xxxx folders then restart the NIC WebServer Service.
This is neither a recommended nor supported procedure, and there may be more to it than meets the eye as I believe there may be references to the correlation rules in some other places (.ini files, etc). I have never tested it myself.
If you remove them, you do so at your own risk. If anyone else has had any success with this procedure, by all means post your steps here.
We disable device types that are not used to improve performance(per an RSA pro-service SE, while at our site) But if a user clicks on any default rule that depends on one of the disabled device types ALL users currently logged in will get kicked out of the GUI. I have opened a ticket on this and the response was that this is a result of multithread code.
So do we give up performance for the sake of users getting kicked out of the GUI if someone inadvertantly clicks on a default rule that is not being used?
Retrieving data ...