Setting event thresholds lets you tailor the frequency of automatic responses to fit the needs and realities of your environment.
Aggregation
Use aggregation to trigger a response for each event or to set the time duration to aggregate multiple events that occur before triggering an automatic response. For example, you can configure an automatic response rule to send an email message when either one of these thresholds is met:
In one hour, the server receives 1,000 or more incidents from different systems.
In one hour, the server receives 100 or more incidents from one system.
You can also set to trigger an automatic response rule if some set number of distinct values occur or for a minimum number of events.
Grouping
Use grouping to combine multiple aggregated events. For example, events with the same severity can be combined into one group. Grouping provides these benefits:
Respond to all events with the same or higher severity at once.
Prioritize events that are generated.