This activity eliminates duplicate events, correlates multiple events, and throttles processing of repeated events. The criticality of the event is assessed to determine if it should be escalated.

Correlated events are either routed for handling within Incident Management or preferably, designated for automated resolution within the scope of Event Management. The Event Management Framework identifies rules used to determine how to process various categories of significant events. This can include opening an incident, changing the status or severity of an event, dropping an event, or sending the event for automated recovery (Resolve Events).