Correlation

The alarms presented by Canopsis are accompanied by additional information that determines whether they are the cause or consequence of another alarm.

Alarm correlation can take place at several levels:

• Thanks to repository information describing links between components
• Thanks to management rules defined by users / administrators
• Thanks to control rules validated by application managers

From an operational point of view, grouping alarms that depend on each other into a meta-alarm is the ideal solution.
possible on an alarm tray, in the APIs.

The basic functions can also be applied in bulk whenever possible.

The alarm correlation results in a significant reduction in the number of alerts presented to
the user.

Update 2024: Pre-correlation time window
Adding the possibility of introducing a delay before performing the alarm correlation. So, when an alert is eligible for a alarm correlation rule, it will only be activated at the end of the desired time delay.

For more information, visit our dedicated article or the Canopsis documentation.