03-16-2007 07:51 AM - edited 03-10-2019 03:31 AM
I wrote a rule with the intent of it firing upon events originating only from public ip addresses AND only for yellow OR red severity levels. However this rule still fires on green severity events. Can any one see why from looking at the rule in the attached graphic?
Thank you,
Mike
P.S. Sorry about the double post.
03-16-2007 09:46 AM
Can you paste a picture of the actual events in an incident? I believe green-level events can still be part of the incident, but you should still have at least 10 yellow or 1 red event also part of the incident.
03-16-2007 11:10 AM
03-16-2007 11:18 AM
I found the problem. There was a red severity event wrapped up in the session that was not visible until drilling all the way down to it. Thanks for the ear.
-mike
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide