Just tried this. Custom events can be used in correlations... however, when going into the advanced thresholds settings, you cannot select Source IP from within your custom group to restrict events with the "same" modifier. So, using the custom groups only gets me halfway there.
↧