Hi Mieke,

When creating correlation rules through automation, the best approach you is follow through SLNetClientTest to see what messages are sent, as correlation offers many different options.

Below is an example of a correlation rule snippet used in our regression tests. This rule creates a correlation rule with a sliding window, applying an alarm filter on a specific element/parameter and a condition based on Critical severity. When triggered, the rule generates an alarm on a different element.

note: This is an internal call and we do not recommend using this, as it is not officially supported and we cannot guarantee that it will still work in the future. As a rule, you should avoid using SLNet calls, as these are subject to change without notice.

private void CreateCorrelationRule(Element _setElement, Element __alarmElement)
{
var definition = new CorrelationRuleDefinition()
{
Name = nameof(RT_CorrelationCleanUP_SlidingWindow),
Folder = "Regression",
GlobalFilter = new AlarmFilter(new AlarmFilterItemParameterID()
{
Field = AlarmFilterField.ParameterID,
CompareType = AlarmFilterCompareType.Equality,
DataMinerID = _setElement.DmaId,
ElementID = _setElement.ElementId,
Parameters = new[] { new ParameterIndexPair(1) }
}),
Conditions = new ExecuteConditionsDefinition()
{
Conditions = new[] {
new ExecuteCondition()
{
Type = ExecuteConditionType.HasAlarm,
Filter = new AlarmFilter()
{
FilterItems = new AlarmFilterItem[] {
new AlarmFilterItemInt()
{
Field = AlarmFilterField.SeverityID,
CompareType = AlarmFilterCompareType.Equality,
Values = new[] { 1 }
}
}
}
}
}
},
Actions = new ActionDefinition[] {
new NewAlarmActionDefinition()
{
Options = NewAlarmOptions.AutoClear | NewAlarmOptions.UpdateBaseAlarms |
NewAlarmOptions.IncludeRuleNameInValue,
DmaID = _alarmElement.DmaId,
ElementID = _alarmElement.ElementId,
ParameterID = 1,
TableIndex = "",
SeverityID = 1,
SeverityRange = -1,
Value = "5"
}
},
IsEnabled = true,
SlidingWindow = new SlidingWindowDefinition()
{
IsEnabled = true,
SlidingWindowOccurrences = 2,
SlidingWindowTime = 90000, //in milliseconds.
ClearMode = SlidingWindowClearMode.AsSoonAsPossible
}
};

var newRule = new UpdateCorrelationRuleMessage()
{
Type = UpdateCorrelationRuleMessage.UpdateType.New,
RuleDefinition = definition
};

Helper.SendMessage(newRule);
}