Even after configuring throttling the same correlation rule is gerating 1000's of incidents every 5 minutes, any idea how to resolve this ?
Can you check values of duration and fields to group by for your specific correlation search?
What you mean by code ?
A good start would be the search that the "correlation rule" that is running and the schedule that's it is running on.
Please post the code, with confidential parts removed or masked, and then maybe we can suggest something.
