it mentioned Wannacry detection way, but when i searched about wannacry in predefined correlation reports, it doesn't exist there: screenshot1


So, I have a question, should I create one for wannacry by myself or it will detect it itself?
Here is my try: screenshot2

Another thing is how I can specify file name created? because there is not filter called "file name" or even in registry key value.

Thank you in advance.