Hi Dojo,
I have two correlation rules, A and B.
In the rule condition for rule B, I want to specify that the rule should trigger a correlated alarm only if an alarm for rule A does not exist.
Is it possible to achieve this?
Hi Catarina,
As discussed, I do not believe correlation is suited to this type of interaction.
Rather, I do believe you would benefit from making correlation rule A and B mutually exclusive by altering the correlation rule to be as restrictive as possible.
If there must be an overlap, I believe alternatives can be offered to indicate when the conditions for rule A are met (e.g. properties).
However, I believe this would be subject to a consultancy ticket as this is an implementation which would need a good design and validation afterwards.