Create an alert correlation rule

Create an alert correlation rule to designate primary and secondary alerts. The primary alert is identified as the root cause of the alert group and the secondary alerts are grouped under the primary alert.

Before you begin

Role required: evt_mgmt_admin

Procedure

1. Navigate to All > Event Management > Rules > Alert Correlation Rules.
2. Click New.
3. On the form, fill in the fields.
   For information on the fields, see Alert correlation rule form.
4. Select Submit.

Result

A rule-based alert group is created when a new alert is generated or when the status of an existing alert changes from Closed or Flapping to Open or Reopened, provided the filter criteria are matched.