http://rdc.gleasy.com/
https://www.netiq.com/documentation/sentinel70/s701_user/data/btgm07l.html
http://www.tibco.com/products/event-processing
Correlation is achieved with state-based and stateless rules. You specify these rules by using XML syntax, defined by the supplied DTD file, tecsce.dtd. The location of the default XML file is $BINDIR/TME/TEC/default_sm/tecroot.xml. Sample XML rule files are provided in the /EIFSDK/samples/state_correlation directory on the IBM Tivoli Enterprise Console Non-TME Installations CD.
Most rules are defined using state machines. A state machine gathers and summarizes information about a particular set of related events. It is composed of states, transitions, summaries, and other characteristics, such as expiration timers and control flags.
There are five state-based rule types: duplicate, threshold, passthrough, resetOnMatch, and collector, all based on state machines. Each state machine looks for a trigger event to start it. There is one stateless rule type: match.
A state-based rule operates on a sequence of events arriving at the state correlation engine, whereas a stateless rule operates on a single, current event. A rule can contain the following elements:
There are six rule types: duplicate, match, collector, threshold, passthrough, or resetOnMatch. Each rule analyzes incoming events based on predicates you specify; depending on this analysis, each received event is either discarded by the rule or forwarded to the actions specified in the rule. (If no action is specified, the events are forwarded to the gateway.)