Configure alert correlation logic order

  • Release version: Xanadu
  • Updated June 16, 2026
  • 1 minute to read

    • Improve alert management by enabling users to customize correlation logic order. This feature empowers you to fine-tune correlation methods to their specific needs, enhancing alert prioritization and response efficiency.

    Before you begin

    Role required: admin

    About this task

    If one of the grouping types is not specified in the property, it needs to be added manually. Alert correlation rules are trigger-based and applied immediately when an alert is created or updated, before other grouping algorithms.

    Procedure

    1. Navigate to All > System Properties > All Properties.
    2. Search for the property sa_analytics.agg.query.group_logic_order.

      Default value is “CMDB,TAG_BASED,PATTERN,TEXTBASE". This is a comma separated list of the grouping types in the order of their execution.

      • CMDB: CMDB grouping
      • TAG_BASED: Tag cluster
      • PATTERN: Automated CI-based patterns
      • TEXTBASE: Text-based grouping
    3. Use the property sa_analytics.agg.query.group_logic_order to define or modify the order of correlation methods based on your preferences.