I think we can’t have correlation on discrete events without ESA or CEP.
The BER option in decoder has no time-bounding, and also it can’t alert
out to email. Kind Regards,
You may want to create a App Rule for the event, and have that as input
to the CEP/ESA, that way the event would be available as 'alert' or
'alert ID' in investigator.