Service Pack 3 (SP3) for Security Manager 6.5 corrects this issue.
Click the following link to download Service Packs for Security Manager (Note: requires access to locked resources)
When you use the Correlation Wizard in SM 6.5.2 and earlier, to create a correlation rule, the Wizard does not display all possible options in the drop-down menu on the Common Fields tab. Because of this limitation, users cannot use fields that are the result of an IP address, security identifier (SID), or globally unique identifier (GUID) lookup as common fields for correlation. By installing SP3 the Correlation Wizard now displays all fields in the drop-down menu.