When the significance has been determined, correlation is used to compare the event with a set of criteria and rules in a specific order. The rules may have either a technical or business focus, but the underlying reason for correlation is to determine the level and type of business impact of the event.
A ‘Correlation Engine’ should be programmed during the Service Design phase, utilizing the guidelines provided by Service Operation. Correlation Engines will use a number of factors to make decisions, including:
* The categorization of the event
* The number of similar events have occurred
* Number of CIs generating similar events
* Whether the event indicates an exception
* A comparison against defined threshold levels (e.g. utilization levels)
* Whether further information is required to investigate further.
These factors should also be used to set a priority level for the event, in order to define the appropriate level of response from the operations group.