Hello,

We are developing a custom action and we are facing the following
problem:

The correlation rule waits for too similar events within 2 minutes. When
2 events occur in less than 2 minutes, action is triggered. However, if
a 3rd event occurs in less than 2 minutes after the second one, the
action is triggered again. We need this not to happen.

Is there a way to clear the correlation buffer after action is
triggered?

Thanks in advance


--
mmarchese
------------------------------------------------------------------------
mmarchese's Profile: https://forums.netiq.com/member.php?userid=1311
View this thread: https://forums.netiq.com/showthread.php?t=53742