Clarify distinction between simulation and real-time correlation in d…

…ecisions

- Add new section explaining simulation vs real-time correlation
- Update simulation testing descriptions to emphasize historical incident analysis
- Clarify that simulation validates logic before real-time application
- Distinguish incident-level simulation from issue-level real-time correlation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

src/content/docs/alerts/organize-alerts/change-applied-intelligence-correlation-logic-decisions.mdx

@@ -25,6 +25,14 @@ We call this correlation logic <DNT>**decisions**</DNT>. We have built-in decisi
   <DNT>**[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Alerts > Incident intelligence > Decisions**</DNT>: Our UI shows how each decision correlates incidents.
 </figcaption>
 
+## Simulation vs real-time correlation [#simulation-vs-decisions]
+
+It's important to understand the difference between simulation and real-time correlation in decisions:
+
+* <DNT>**Simulation**</DNT>: Simulation correlation involves analyzing two separate incidents to understand their relationship under simulated conditions. These incidents can originate from either the same underlying issue or from different issues. The focus is on determining potential causative factors or shared characteristics between individual incidents. Simulation helps you test and validate your correlation logic against historical data before applying it in real-time.
+
+* <DNT>**Real-time correlation (decisions)**</DNT>: In contrast, real-time correlation targets distinct issues, with each issue potentially encompassing multiple incidents. The aim is to detect and connect patterns across these multiple incidents to identify underlying issues for more efficient correlation. Real-time correlation leverages live data streams, allowing for prompt identification and response to emerging problems.
+
 ## What is correlation and how does it work? [#what-is-correlaton]
 
 Your most recent and active incidents are available for our correlation logic. For example, let's say your system has received two alerts saying a synthetic monitor is failing in Australia and London. These two alerts will have created their own unique incidents. Those incidents will generate their own unique issues based on your teams existing [incident creation policy](/docs/alerts-applied-intelligence/new-relic-alerts/alert-policies/specify-when-alerts-create-incidents/#preference-target). The correlation logic of New Relic will then test those incidents against each other to find similarities. In this case, it's the same monitor that is failing across multiple locations, so New Relic will merge both incidents into a single issue that contains each relevant event.
@@ -412,7 +420,7 @@ The time range is set to 20 minutes by default. You can adjust it between 1-120
 
 #### Step 5: Testing your decision using a simulation [#basic-test-with-simulation]
 
-After adding a filter logic, the system automatically runs a [simulation](#simulations) using the past 7 days of incident data.
+After adding filter logic, the system automatically runs a [simulation](#simulations) using the past 7 days of incident data. Simulation analyzes how your correlation logic would have worked on two separate historical incidents to help you validate the decision before applying it to real-time correlation.
 
 You can also manually trigger the simulation by clicking <DNT>**Simulate**</DNT>, which you may want to do if something is changed in the decision.
 
@@ -1264,7 +1272,7 @@ The decision builder follows the standards outlined in [these documents for regu
 
 ## Correlation assistant [#assistant]
 
-You can use the correlation assistant to more quickly analyze [incidents](/docs/alerts-applied-intelligence/new-relic-alerts/get-started/alerts-ai-overview-page/#incidents), create decision logic, and test the logic with a simulation. To use the correlation assistant:
+You can use the correlation assistant to more quickly analyze [incidents](/docs/alerts-applied-intelligence/new-relic-alerts/get-started/alerts-ai-overview-page/#incidents), create decision logic, and test the logic with a simulation on historical incident pairs before applying it to real-time issue correlation. To use the correlation assistant:
 
 1. Go to <DNT>**[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Alerts > Issues & activity > Incidents**</DNT> tab.
 2. Check the boxes of incidents you'd like to correlate. Then, at the bottom of the incident list, click <DNT>**Correlate incidents**</DNT>.
@@ -1297,7 +1305,7 @@ You can use the correlation assistant to more quickly analyze [incidents](/docs/
 
 ### Using simulation [#simulations]
 
-Simulation will test the logic against the last week of your data and show you how many correlations would have happened. Here's a breakdown of the decision preview information displayed when you simulate:
+Simulation tests your correlation logic by analyzing two separate incidents from the last week of your data, showing you how many correlations would have happened. This allows you to validate your decision logic before it's applied to real-time correlation of issues. Here's a breakdown of the decision preview information displayed when you simulate:
 
 * <DNT>**Potential correlation rate:**</DNT> The percentage of tested incidents this decision would have affected.
 * <DNT>**Total created incidents:**</DNT> The number of incidents tested by this decision.