Correlation event is done at global level, but it could be very useful to have it at host level.
For instance, sometime you want to catch critical windows events. But as you don't know which event, you create a generic mutiple event trigger. Sometime the same event is repeated by the system or application, and you wouldn't like to generate a new event whereas there is already existing one. So if we could be possible to create a correlation rule based on tag and host, it would be very useful.
Regards,
Marc