We currently use a correlation rule to generate fast alerts when dual source outages occur for a given service, which works well.

Separately, we have a more relaxed threshold in place that triggers a single source outage alert when only one source fails. However, this can lead to noisy or redundant alerts, especially in scenarios where the dual source outage has already been detected.

I’m looking to create a new correlation rule or modify the existing logic so that:

• If a dual source outage alert has already been raised for a specific service,

• Then any subsequent single source outage alert (for that same service and timeframe) — for either source — is suppressed or blocked.

This would help streamline incident visibility and reduce alert fatigue.

Has anyone implemented logic like this in DataMiner using correlation rules before? I’m open to suggestions or example configurations if available.