Out of the box situations are normally associated with the component nodes they relate to. When the situation fires and the alert icon is created, it will appear against the component node it is associated with.

e.g. a yellow warning triangle or a red critical circle

This makes it easier to look at the TEP console, see the alert and understand which component it is originating from. . It is possible to associate all the situations at the managed system level if you prefer, but you would then need to look carefully at each alert to understand where it originates from.

In the screenshot below I have 3 situations associated to the Disk Usage subnode. If any of these 3 situations fire I will see the alert icon next to the Disk Usage node as well as the Linux OS (managed system) level and Enterprise top level. This gives me a visual cue the problem is at Disk Usage level.

The icon highlighted in red is the 'Set situation filter criteria' button which allows me to associate a given situation to a given sub node. As a best practice this can be used to associate the situation to the component node you would like the alert to displayed against if you create your own custom situations