Hi. I'm curious as to what will happen if I define multiple correlation rules that have overlapping filters - specifically will the base alarm that matches multiple correlation rules fall in to the bucket for each of those correlation rules, or will there be some sort of selection criteria?
Thanks
Hi Oliver,
Each alarm will be handled independently by each correlation rule in the system. In other words, it is indeed possible that one alarm matches the filter of two or more correlation rules and will end up in both or more buckets.
If it would not be like this, it would be possible to create a new correlation rule and break other rules that were already created in the system maybe even by other people. That's not something you would expect as a user.
Bert
Brilliant, thanks for the quick response, Bert. That was certainly the answer I was hoping for. Kind regards, Oliver.