Few of the alerts are undergoing manual grouping automatically.
The group type is coming up as Manual on the parent alert and on the child alerts, I see the below work note:
"The alert was added manually to the group as a secondary alert to primary alert <u><a href="/em_alert.do?sys_id=XYZ">AlertXXXX</a></u> by user system."'
The below work note is being added in the parent alert:
Alert <u><a href="/em_alert.do?sys_id=XYZ">AlertXXXX</a></u> was added manually to the group as a secondary alert by user system.
There are no alert correlation rules defined for this Source, what could be the reason?
