correlation handler

Problem Sometimes you may wan’t to trigger an alert only if one event persists longer than x minutes and isn’t followed by an log entry