Hello All,

When using Correlation rule actions to send email alerts, what options exist to keep the emails from occurring if they have occurred X number of times in the last X number of minutes/hours?

Note: The Rules in place today are using the persistent event configuration so that emails are only sent after the condition is satisfied for 3 minutes.

Adding Hysteresis to alarm templates is not a good option as we don't always want to hide flapping alarms.

I'm also curious if there is an option to Mask alarms after X occurrences - which should also keep emails from being sent once masked.

Thank you in advance!