Can you in any way, use correlation to de-escalate an alarm.. so from Critical to Major for example.
Hi Ken,
Currently there is no action on correlation rules to de-escalate alarms (only to escalate alarms). A possible workaround is to create a correlation rule that creates a correlated alarm that will update the base alarm to a different severity. In the example below, I created a correlation rule to update the initial severity of an alarm from Critical to Minor:
Hi Miguel,
I wanted to post the same question/suggestion – to investigate feasibility of a 'de-escalate' events through correlation.
The proposed solution (creating a new event) is not exactly the same as it will create a NEW event with its own root-id so the link to the initial alarm is lost.
So I wonder if there is any means to keep the link with the original event in a similar way that escalation will work.
If not I will post a new feature request….
Hi Miguel..
Yes thats the way I thought.. Thanks ..