Hi,

We're building some correlation rules for our system, and were wondering what the impact is of ordering multiple filters.

For example, we'd like to get all Critical alarms for a specific Protocol - we're thinking to filter by protocol first, then filter by severity.

Does this ordering matter, and how impactful would it be? Based on the answer, we might go back and redo some existing correlation rules to be more efficient.

Thanks!