I'm finding very useful the event correlation system to limit the notifications generated by events impacting on multiple hosts.

In a hierarchical system, if a "parent" host manifests a problem (for example, it does not respond to the ping), the "child" host may also not be reachable. With the event correlation is possible to automatically close all the problems of the "child" hosts.

If we always take ping as an example, the problem is generated and closed every minute.

It might be useful to add to the operations of the event correlation, the possibility to change the severity of the problem (new or old), without closing it.

With this system you can get a clearer detail the impact perimeter of the parent issue, while avoiding unnecessary notifications