Have you ever correlated multiple events, but then when all the Symptoms events were closed the Cause event remained open? A typical use case for such scenario is using Stream Based Event Correlation (SBEC) to create new event when some condition happens, for example Repetition rule or Combination rule. When creating the new event, you can make it as Cause event for the original events. In such case, there is no “back to normal” event which will automatically close the Cause event.
This Content Pack will help you with such scenario. It can close Cause event when all its Symptoms are closed. The Cause event closure can happen immediately or with some delay (in case of Cause event generated by SBEC rule, you may want to keep the Cause event open until the end of the correlation window, otherwise, future events matching the correlation condition will be added to previous Cause event, and since it was closed, all new Symptom events will get closed too).
first release
Please upgrade to one of the following broswers: Internet Explorer 11 (or greater) or the latest version of Chrome or Firefox
