ESA Rule- How to avoid reiteration of notification in console

[VarunGovindaraj]

Hi,

For the ESA Rule is there an option not to create additional notifications for certain time post first notification. For example lets take an alert logic where the requirement is to alert multiple failed login attempted by User A for 5 times in 2 minutes where in I could create rule logic but could not restrict in such a way that once alert has triggered alert for same user should not be triggered for say next 6 hours.

Any suggestions is much appreciated.

Regards,

Varun P G

[sravan.koneti]

Varun Govindaraj‌,

Please use OUTPUT FIRST EVERY 6 hours; syntax in Rule for supressing duplicate alerts for 6 hours.

Refer https://community.rsa.com/docs/DOC-104243 

[VarunGovindaraj]

Hi Sravan,

Would there be any performance issue which I should think about on the time window?

Regards,

Varun P G

[sravan.koneti]

Hi Varun Govindaraj‌,

This will not impact performance of ESA. But, advances to avoid duplicate alerting.