Forum Discussion

Copper Contributor

May 23, 2022

Solved

Alert grouping does not work

Hi team,

We have an analytics rule that will run every hour. We have configured the alert grouping to "Grouping alerts into a single incident if all the entities match" for the 7-day time frame.

However, the incidents are keeping triggering every hour. May I know if there is any approach to troubleshoot the issue or how to check the config? Thanks

alerts

analytics

siem

GaryBushey
May 25, 2022
It will not work if the incidents are closed unless the switch to re-open a closed matched incident is enabled. I don't see any reason why it wouldn't have worked before you closed everything.

8 Replies

burasathi
Copper Contributor
Aug 08, 2023
Steven_Su
Hello Steven,

I have similar problem but in my case I don't have automation and sentinel is not grouping the alerts even though the entity is matching, so can you please let me know is the entity you are using in this rule client_ipaddress_s a list of IPs or single IP?
GaryBushey
Bronze Contributor
May 23, 2022
Steven_Su Have you verified that the incidents in each alert matches exactly (number and names) to the one another?
- Steven_Su
  Copper Contributor
  May 23, 2022
  Hi GaryBushey
  Yes, for example, i search the IP entity and find all the incidents related to it. They only have 1 entity and it is the same, but the alerts were not aggregated into a single incident.
  - GaryBushey
    Bronze Contributor
    May 24, 2022
    I see that these are all closed. Do you have your analytic rule grouping set to re-open an incident if a matching alert is to be added to it. It would be below the area your original screenshot shows.