Forum Discussion

TheHoff70's avatar
TheHoff70
Brass Contributor
Jan 08, 2024
Solved

Prevent alert grouping from changing severity?

Greetings   I have a situation where an automation rule, as I understand it, doesn't have effect or isn't triggering. I need some help figuring out if I've missed something. My end goal is to preve...
siem
  • GBushey's avatar
    GBushey
    Jan 09, 2024
    It looks like you are checking for two different values for the Severity: "Changed to High" and "Equals Low" which are mutually exclusive so the rule would not fire.
GBushey's avatar
GBushey
Former Employee
Jan 09, 2024
It looks like you are checking for two different values for the Severity: "Changed to High" and "Equals Low" which are mutually exclusive so the rule would not fire.
  • TheHoff70's avatar
    TheHoff70
    Brass Contributor
    Jan 10, 2024

    GBushey 

    Good point. My logic was was that the trigger should be the original severity of the incident. I've changed the automation to "Severity - Changed From" instead.

    Update: After changing the automation to "Changed From" I can verify the automation rule is working as intended.

     

    /Fredrik