Hello Dojo,
I have a question about the correlation rules.
For the example:
I have 50 items of a procotole X
In 2 weeks, I will have 100 elements of the same protocol
I want an alarm to be triggered as soon as 50% of the elements are in alarm
Currently, it works as follows in the "Rule Condition" part:
Is Script condition count(*)>=25
Is there a way to express my request in % in a correlation rule?
For example, 50% of X protocol elements in alarm = major alarm
Is this possible?
I've been to the documentation, and nothing is close to my problem.
Sincerely
Hi Alexandre,
For correlation conditions, there are no other functions available besides the ones mentioned in the documentation.
Hardcoding the value in the correlation rule (as you did) is about the only option. Alternatives could be to store the limit somewhere in a property or parameter and access it through functions like property(View.PropName) or parameter(123,456,7), but that also would mean that the value needs to be stored somewhere and kept up to date when elements get added.
Okay, thanks for your answer, I’ll see what I can do