Hi,

At the moment it is not possible to correlate events based on tag values with a CONTAIN option. I am working in a situation where I run into the following. We have two hosts:

• DP1001

• GW-DP1001

I want the Global Event Corellation rule to do a function like this:

But intstad of EQUALS I want to use CONTAINS. This way we can make sure that the on a host/trigger level we use the built in macro's to contain {HOST.HOST} and correlate all events based on a contain of the Gateway device (GW-DP1001) in front of the edge device (DP1001). 

This option is not available now, but would give us way more flexibility:

Would be a nice addition! 

Kind regards,

Nathan