How to create a alert from a high severity correlated event ?

[Former Member]

I'm trying to figure out  an easy way to create an email alert from all high severity correlated event. In the field match i dont have that field available.

I'm runnig version 9.3.1.

thanks.

[acommons]

You will probably have to create another correlation rule that looks at the other correlation events and triggers when the severity exceeds your threshold.

Ugly I know but the filters on alarms are a bit primitive compared with other parts of the product and this has generally been the approach which gets some traction for me.

cheers,

Andrew