Location-Based Alert Correlation Rule Not Working as Expected

[Durgaprasad Joi]

We are attempting to correlate alerts generated from the same location based on the Configuration Item (CI) within a 15-minutes timeframe. We have implemented the approach below, but it is not working as expected.

• We created an Alert Correlation Rule using an Advanced Script (script attached).
• The objective is to correlate network device alerts originating from the same location within a 15-minute window.
• The earliest alert should be designated as the Primary Alert, while subsequent alerts should be marked as Secondary Alerts.
• Additionally, the 'Classification' field of secondary alerts should be updated to "Security".

Note: As of now for other correlation rules, both primary and secondary alerts are creating incidents. Our requirement is to have only a single incident created for the location based correlation. To identify such secondary alerts and prevent incident creation, we are attempting to update their Classification field to "Security", so that we can filter this in alert management rule.

Could you please review the approach and advise why the correlation rule is not working? Is there a better way to handle this scenario?

Filter condition used in the alert correlation rule: sourceSTARTSWITHSolarWinds^descriptionLIKECreateINC#<True>#^cmdb_ciISNOTEMPTY^EQ
Order Number: 90(Other correlation rule has order number 100)