Hi Alexis,

The alarm storm protection feature in Cube is a pure client side feature. It takes the settings from the user settings, which allows to behave different from one user to another. So User1 can configure it to be active starting from 100 alarms, while User2 can activate the feature from 1000 alarms.

The alarms you see in your console aren't really alarms that come from the server. Those 'alarms' are actually fake and are being 'created' by Cube on the client based on the user settings like described ^^.

Because those alarms aren't real, correlation will not receive them and so you cannot use them to trigger any correlation.

The only thing you can do in correlation is mimic the same behavior in a rule by grouping your alarms by parameter (grouping section) and add a condition with a count (count(*) > 1000). But of course this is yet another configuration and might differ from what your users have configured.

Hope this explains it a bit and inspires you with a way forward.