Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Update change-applied-intelligence-correlation-logic-decisions.mdx
  • Loading branch information
sujitnewrelic committed Dec 4, 2025
commit 49aa37f6c07770138b0e729a40e40c7e6c19bb98
Original file line number Diff line number Diff line change
Expand Up @@ -25,14 +25,6 @@ We call this correlation logic <DNT>**decisions**</DNT>. We have built-in decisi
<DNT>**[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Alerts > Incident intelligence > Decisions**</DNT>: Our UI shows how each decision correlates incidents.
</figcaption>

## Simulation vs real-time correlation [#simulation-vs-decisions]

It's important to understand the difference between simulation and real-time correlation in decisions:

* <DNT>**Simulation**</DNT>: Simulation correlation involves analyzing two separate incidents to understand their relationship under simulated conditions. These incidents can originate from either the same underlying issue or from different issues. The focus is on determining potential causative factors or shared characteristics between individual incidents. Simulation helps you test and validate your correlation logic against historical data before applying it in real-time.

* <DNT>**Real-time correlation (decisions)**</DNT>: In contrast, real-time correlation targets distinct issues, with each issue potentially encompassing multiple incidents. The aim is to detect and connect patterns across these multiple incidents to identify underlying issues for more efficient correlation. Real-time correlation leverages live data streams, allowing for prompt identification and response to emerging problems.

## What is correlation and how does it work? [#what-is-correlaton]

Your most recent and active incidents are available for our correlation logic. For example, let's say your system has received two alerts saying a synthetic monitor is failing in Australia and London. These two alerts will have created their own unique incidents. Those incidents will generate their own unique issues based on your teams existing [incident creation policy](/docs/alerts-applied-intelligence/new-relic-alerts/alert-policies/specify-when-alerts-create-incidents/#preference-target). The correlation logic of New Relic will then test those incidents against each other to find similarities. In this case, it's the same monitor that is failing across multiple locations, so New Relic will merge both incidents into a single issue that contains each relevant event.
Expand Down Expand Up @@ -420,7 +412,7 @@ The time range is set to 20 minutes by default. You can adjust it between 1-120

#### Step 5: Testing your decision using a simulation [#basic-test-with-simulation]

After adding filter logic, the system automatically runs a [simulation](#simulations) using the past 7 days of incident data. Simulation analyzes how your correlation logic would have worked on two separate historical incidents to help you validate the decision before applying it to real-time correlation.
After adding filter logic, the system automatically runs a [simulation](#simulations) using the past 7 days of incident data to help you validate the decision before applying it.

You can also manually trigger the simulation by clicking <DNT>**Simulate**</DNT>, which you may want to do if something is changed in the decision.

Expand Down Expand Up @@ -1272,7 +1264,7 @@ The decision builder follows the standards outlined in [these documents for regu

## Correlation assistant [#assistant]

You can use the correlation assistant to more quickly analyze [incidents](/docs/alerts-applied-intelligence/new-relic-alerts/get-started/alerts-ai-overview-page/#incidents), create decision logic, and test the logic with a simulation on historical incident pairs before applying it to real-time issue correlation. To use the correlation assistant:
You can use the correlation assistant to more quickly analyze [incidents](/docs/alerts-applied-intelligence/new-relic-alerts/get-started/alerts-ai-overview-page/#incidents), create decision logic, and test the logic with a simulation. To use the correlation assistant:

1. Go to <DNT>**[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Alerts > Issues & activity > Incidents**</DNT> tab.
2. Check the boxes of incidents you'd like to correlate. Then, at the bottom of the incident list, click <DNT>**Correlate incidents**</DNT>.
Expand Down Expand Up @@ -1303,6 +1295,14 @@ You can use the correlation assistant to more quickly analyze [incidents](/docs/
</Collapser>
</CollapserGroup>

### Simulation vs real-time correlation [#simulation-vs-decisions]

It's important to understand the difference between simulation and real-time correlation in decisions:

* <DNT>**Simulation**</DNT>: Simulation correlation involves analyzing two separate incidents to understand their relationship under simulated conditions. These incidents can originate from either the same underlying issue or from different issues. The focus is on determining potential causative factors or shared characteristics between individual incidents. Simulation helps you test and validate your correlation logic against historical data before applying it in real-time.

* <DNT>**Real-time correlation (decisions)**</DNT>: In contrast, real-time correlation targets distinct issues, with each issue potentially encompassing multiple incidents. The aim is to detect and connect patterns across these multiple incidents to identify underlying issues for more efficient correlation. Real-time correlation leverages live data streams, allowing for prompt identification and response to emerging problems.

### Using simulation [#simulations]

Simulation tests your correlation logic by analyzing two separate incidents from the last week of your data, showing you how many correlations would have happened. This allows you to validate your decision logic before it's applied to real-time correlation of issues. Here's a breakdown of the decision preview information displayed when you simulate:
Expand Down
Loading