Selecting a parent event for a correlation rule
You can select the parent event for the correlation rule
About this task
To select the parent event for the correlation rule, complete the following steps. If you want to see automated suggestions about the parent event for a group, see configuration details in Adding columns to seasonal and related event reports.
- View all events that form a correlation rule, see Viewing events that form a correlation rule
- In the Related Event Details portlet,
within the Correlation Rule tab, right-click
an event and select
Use Values in Parent Synthetic Event.
Use Values in Parent Synthetic Event column
for the selected event updates to
Yes, which indicates
this event is now the parent event.
For a related events group, if all of the children of a parent synthetic event are cleared in the Event Viewer, then the parent synthetic event is also cleared in the Event Viewer. If another related event comes in for that same group, the parent synthetic event either reopens or re-creates in the Event Viewer, depending on the status of the parent synthetic event.