Correlation

The alarms presented by Canopsis are accompanied by additional information that determines whether they are the cause or consequence of another alarm.

Correlation can take place at several levels:

• Thanks to repository information describing links between components
• Thanks to management rules defined by users / administrators
• Thanks to control rules validated by application managers

From an operational point of view, grouping alarms that depend on each other into a meta-alarm is the ideal solution.
possible on an alarm tray, in the APIs.

The basic functions can also be applied in bulk whenever possible.

The correlation results in a significant reduction in the number of alerts presented to
the user.

Update 2024: Pre-correlation time window
Adding the possibility of introducing a delay before performing the correlations themselves. So, when an alarm is eligible for a correlation rule, it will only be activated at the end of the desired time delay.

For more information, visit our dedicated article or the Canopsis documentation.