Specify Correlation Rule Causes

In this task, you learn how to specify the event that you want to define as the cause in a correlation rule. You define the cause of a correlation rule by specifying an indicator state used to monitor a particular event in your IT environment, for example: Network:Unreachable.

To specify causes in a correlation rule:

1. Open the Correlation Rules manager:

   Administration > Event Processing > Correlation > Topology-Based Event Correlation

   Alternatively, click Topology-Based Event Correlation.

2. Create a (or open an existing) correlation rule. For more information about creating correlation rules, see Create Event Correlation Rules.

3. In the Rule Topology pane, select the configuration item type for which you want to select the cause.

4. In the Indicators pane, right-click the indicator state you want to use as a cause in the correlation rule, and select Add as a Cause from the context menu.

   The selected indicator state should appear in the list of symptoms and causes in the Symptoms and Causes pane.