Correlated events are determined based on the Correlation and the field is set to C. However, the following are the exceptions:
field being set to null or any value. The field is set to the name of the Correlation rule that triggered the Correlated event. This value is set only when the event is generated by the Correlation engine. The field is set toThe gui only.
field is set to T for the Correlated events that are routed toThe
field might not be when the event action is used because this action updates the correlated event Resource field.The
option is enabled only for Correlated events.In the Real-Time event table of the Navigator or Snapshot, or an Event Query table, right-click a Correlated event, and select
.A window displays showing the events that triggered the rule and the name of the Correlation Rule.
NOTE:For Correlated events, Trigger events are not available if events were routed to GUI only. However, the
option is enabled even if the Trigger events are not available.