Hi Bruno,

That should be possible. There are some different variations of what you say, depending on if you want that for that one single element or all elements of that type.

Go to the Correlation module, and create a new rule.

First define an Alarm Filter.  This one defines which alarms will be considered and processed by the correlation rule, amongst all of the alarms happening in the system.  In your case you would filter on the protocol (if you want this for all elements of that type) or on element (if you just want it on one specific element), and then you would further filter down with the four parameter descriptions that you want.  So essentially you create a filter to isolate those four alarms.

Then you have a Alarm Grouping option.  This is like taking the alarms that pass through the filter, and organizing them in different buckets to evaluate.  E.g. if you want this to work on all elements of a specific type, and you filter is based on protocol, you will use the buckets to group them by element (because you want to evaluate if all four alarms are present on an element).

Once you filtered out the alarms, and grouped them, you need to evaluate those groups.  That's the Rule Condition. You can work with a Filter again or with a Condition.  You can probably go with a simple condition that does a count (i.e. you already filtered on the right alarms to come through, and you want to know if there are 4 in total).

As an action you would choose for a New Alarm on the same base element.

The devil is in the details of course, but I believe the above should more or less give you the desired result.

REPONSE UPDATE:

I did a quick test with two metrics, and it seems to work for me.  See screen caps below of the rule and the results.  Note again, the devil is in the details, and you should play with it to make sure that it is what you need, because within the definition of your use case there are various flavors still possible.