Forum Discussion

GaryBushey's avatar
GaryBushey
Bronze Contributor
Feb 19, 2020

Question on the new Incident Settings page in Analytics rule creation

Looking at this new page I see there is a setting where you can enable or disable the creation of Incidents from this analytics rule.  Why would you do that?  Isn't the purpose of an alert to create ...
mclaes's avatar
mclaes
Brass Contributor
Feb 19, 2020

GaryBushey I have the opposite problem that a rule (a default one it seems) does not produce accurate results and thus generates alot of 'false positive incidents' that skew my newly create PowerBi inc dashboard 🙂 

 

About the alerts - incident relationship.. I had some past experience on Arcsight/Logrhythm where we wanted to generate alerts but not immediately report them to analysts via tickets but rather use alerts in other analytics rules. if that makes sense. Or have an alert rule in 'test/dev' mode without generating incidents.

 

I agree on the notification part. It would be great to have some 'release notes' banner/button/page on the portal to skim through new changes. All (cloud) products change so fast its really hard to keep up with all 'unannounced changes'.