Hello, I have a requirement to count base alarms in a correlation rule but count them using the following logic (so a range of >= 4 and <7; i.e. 4, 5, or 6):-
Is Script condition count(*) >=4
Or Script condition count(*) <7
So I want the conditions above to only count alarms within the range of >= 4 and <7; i.e. 4, 5, or 6.
However, if you observe the oder of the conditions, you will see that the first script condition will include everything above 4 anyway and would negate the second script condition.
My question is, can you in any way combine these two conditions into one so that it counts within the range?
How else could you perform this. The existing documentation does not specify any other methods.
Yes, the order of the scripts and the use of the 'And' operator appears to generate the desired results. Many thanks for you input