SN System Properties Reference
Property reference

sa_analytics.agg.query.group_logic_order

The sa_analytics.agg.query.group_logic_order property specifies the sequence of correlation methods used to aggregate alerts into groups. Adjusting this order can enhance alert prioritization and response efficiency based on specific operational needs.

Default
MIXED,NETWORK_TRAFFIC,PATTERN,GENERALIZED_PATTERNS,TEXTBASE
Type
string
Application
Global

Key questions about this property

The answers below summarize the purpose, scope, default effect, and review scenarios for this property.

What does it do? This property configures the execution order of various alert grouping methods, allowing for tailored alert aggregation strategies.
What area does it affect? Alert aggregation and correlation
What does the default mean? The default value is "MIXED,NETWORK_TRAFFIC,PATTERN,GENERALIZED_PATTERNS,TEXTBASE", which is the baseline setting used unless it is changed.
When should you review it? Review this property when optimizing alert management strategies or adjusting correlation methods.

Out of the box property record

Raw metadata from the property record.

Property name sa_analytics.agg.query.group_logic_order
Sys ID 9950d65e77230210034fef00af5a9932
Type string
Application Global
Default value MIXED,NETWORK_TRAFFIC,PATTERN,GENERALIZED_PATTERNS,TEXTBASE
Description This property determines the order in which correlation methods are used to aggregate alerts into groups.
Updated 2026-04-13 07:07:09

Sources

Official references and nearby text excerpts where this property appears.

Documentation excerpt View supporting context
Context preview Snippet 1
... specific needs, enhancing alert prioritization and response efficiency. Before you begin Role required: admin Procedure 1. Navigate to All > System Properties > All Properties. 2. Search for the property sa_analytics.agg.query.group_logic_order. Default value is “MIXED,NETWORK_TRAFFIC,PATTERN,GENERALIZED_PATTERNS,TEXTBASE". This is a comma separated list of the grouping types in the order of their execution. Note: If one of the grouping types is not specified ...

More in sa_analytics

Other properties in the same namespace.

sa_analytics.agg.group_alert_with_same_group_by_fields It specifies which fields' values must match for alerts to be grouped, enhancing the correlation of related al sa_analytics.agg.learner_group_by_property This property determines the specific field by which alerts are grouped during the alert aggregation process, sa_analytics.agg.learner_rca_detection This property activates root cause analysis specifically for Automated groups based on configuration item (CI) sa_analytics.agg.mi_graph_enabled This property determines whether the Mutual Information Graph Aggregator is active, affecting how data is aggr sa_analytics.agg.query_cmdb_graph_walk_nodes This property limits the number of CI relationships considered when grouping alerts into a CMDB group, directl sa_analytics.agg.query_cmdb_rca_enabled This property activates root cause analysis features for CMDB groups, allowing for better insights into config sa_analytics.agg.query_cmdb_strongly_connected_graph_enabled This property activates the functionality for generating a strongly connected graph representation of the CMDB sa_analytics.agg.query_cmdb_suggested_relationship_enabled This property determines whether suggested relationships from the CMDB Group CI Relations table are utilized w

All 37 properties in sa_analytics →