The current event correlation rules have only 2 operations Close new events & Close Old events. I think it would be better to have suppress Old/New events with an option to suppress until the suppressor event closes + some grace time.

Eg:
Current implementation:
If my router goes down all nodes connected to it also goes down. I'm checking on ICMP Ping and closing the old and new events of Nodes when router is down.

But the actual problem here is ICMP down events are repeating every 1min on all nodes and this event correlation rule is closing the event all the time. Which resulting in multiple events creation and closure within small time frame.

This effects the event correlation engine on heavy load as well as several events getting generated and closed immediately which will definitely effects the server performance.

*Suggested Implementation:
*
If my router goes down and would like to have option to suppress all old and new node down alerts with suppress until option set to Router down event closure time + (5Mins) sometime (option to provide grace time).