Basic components of BMC Defender Server correlation - Documentation for BMC Defender SIEM Correlation Server 6.2

Action component—The purpose of the Correlation / Action component is to actually cause some action to occur in response to a message. This action is triggered by any message, but is typically triggered by an Alert, and used in conjunction with a Trigger so that actions occur only when specific messages correlate at specific rates as qualified by previously received messages. 

Example

An action might occur if a particular class of event occurs higher a certain counts per minute, (as detected by the Alerts component) and only if some previous event has occurred at a specific time.

The components work together to furnish powerful correlation capability. Each of the preceding components is an atomic component that can be used in a larger correlation strategy. You can configure Triggers, that enable thread counters, that generate alerts, which are further correlated by threads, triggers actions and  are enabled by other Triggers.