A customer asked me the following:

“I'm trying to trigger a script every time an element is in timeout. To achieve that, I created a correlation rule that captures the timeout but is failing at the return to normal (communication restored, timeout gone).

This is the correlation rule that I have:

The timeout is captured correctly; however, during the return to normal, other events are also captured.

How can I create a rule that captures ONLY the events related to timeout?”