We are in the process of migrating AD monitoring from MS SCOM into SAM. One of the things I cannot figure out is how to correlate offsetting event IDs' As an example event ID 4013 will trigger indicating an issue with DNS, and event ID 4 will trigger notifying that the issue is no longer present.
How can I within the component monitor tell the monitor to go up once event ID 4 is found ? Within the component monitor it appears we can only define what constitutes up/down.
