I have an alert that can clear in the same minute that it originally fired. When the correlation search runs, both events are in it, the alert and the clearing alert. The correlation search creates notable events for each but uses the current time for the _time for the notable events and not the _time from the original alerts. Since both alerts are converted into notable events during the same correlation search run, they get the exact same timestamp. This causes ITSI to not definitely know the correct order of the events and it sometimes thinks the Normal/Clear event came BEFORE the original alert.
This seems odd to me. I would have imagined that ITSI would use the original event time as the _time for the notable event but it doesn't.
Any ideas on how to address?
