Multiple corrélations rules types

[JosephSan]

Hello Community,

I'm trying to make multiple correlations rules but I would like them to be able to interact with each other.

For example : 

1)  Rules Based :

• Primary -> Host_Check alerts (ping KO for a CI).
• Secondary -> Any others alerts on the same CI.

2) Tag Cluster :

• Any Host_Check alerts with same CI Location.

I know that correlations rules have only one level. But if the first correlation is active on a CI, when an alert is created on a second CI and match correlation rule n°2, I want the alerts attached to it.

Maybe for correlation n°2 another method exists ?

Should i use a script in advanced mode ?

Thank you.

Joseph

[JosephSan · Accepted solution]

Hi,

I found a simpler solution by adapting the example in this article  :

https://www.servicenow.com/community/itom-forum/article-alert-correlation-rule-advanced-script/m-p/2...

I use the same type of correlation (Rules-Based) for the HOST_CHECK and for the location. So the priority rules work as desired. I still have to do quite a bit of testing but it looks good.