Basic Components of Bmc Defender Server Correlation - Documentation for Bmc Defender Siem Correlation Server 6.2

Action component—The purpose of the Correlation / Action component is to actually cause some action to occur in response to a message. This action is triggered by any message, but is typically triggered by an Alert, and used in conjunction with a Trigger so that actions occur only when specific messages correlate at specific rates as qualified by previously received messages. 

The components work together to furnish powerful correlation capability. Each of the preceding components is an atomic component that can be used in a larger correlation strategy. You can configure Triggers, that enable thread counters, that generate alerts, which are further correlated by threads, triggers actions and  are enabled by other Triggers.