Forum Discussion

Copper Contributor

Oct 15, 2020

Ignore alerts if Entities Match previous within the last 24 hours

I have a Proofpoint TAP connected to Sentinel. When a User clicks on a Malicious link in an email, one of our remediation steps is to have the user change their password. I have encountered a situati...

sammyredo

Copper Contributor

Oct 15, 2020

LodewykV I have configured to group the alerts if the entities match. I have a question about that function though. So I have configured my query to run every 5 minutes. If I set to limit the group to alerts created within 1 hour and After the first alert is generated the first query run, will the subsequent alerts be added to the 1st, and won't they trigger an automated playbook? I get that the alerts generated within the hour will be grouped. My question however is how will that affect the automation? The first query runs and generates an alert which triggers a playbook. Query runs again after 45 minutes and generates another alert with same entities, will that trigger the playbook, or it will just be added to the first alert and not trigger the playbook?

Thijs Lecomte

Bronze Contributor

Oct 15, 2020

Currently there is only one automation possible, which runs everytime an alert is created. So even when the same incident has multiple alerts, it will run multiple times.

There is a new possibility in private preview, which will only trigger once per incident. This would be a solution for you, but it's not GA yet.

sammyredo
Copper Contributor
Oct 15, 2020
Thijs Lecomte You might be referring to "When Azure Sentinel incident creation rule was triggered"?

Thank you for the response
- Thijs Lecomte
  Bronze Contributor
  Oct 15, 2020
  Yes, it is!
  - sammyredo
    Copper Contributor
    Oct 15, 2020
    Thijs LecomteThank you! But is there a way to stop alerts from generating for the same entities repeatedly, especially if the source is only generating one of such alerts?