Event/Alert correlation based on alert description

[chandrakumar]

Hello All,

I have a requirement to correlate or group events/alerts based on their descriptions, provided they originate from the same location and organization.

For example, alerts with descriptions such as "device down", "CPU high", or "memory high" should be grouped together if they are from the same location and organization for the duration of 30 min, regardless of the node name.

Could someone please advise on how this can be implemented?

[chandrakumar]

Thanks @AJ-TechTrek  Ajay.