Informer alert question

[ThomasSchaub]

Hello All -

Running Informer 2.0.5.6 and would like to create an alert only when a certain event exceeds a threshold.  For example HTTP GET sessions to a Web server is greater than x/per minute.  I've tried using the 'min_threshold' rule action, but the alert still fires even when x is less than the min_threshold value.  Am I taking the right approach?  Any/all thoughts/insights appreciated.  Tnx, Tom

[RSAAdmin · Accepted solution]

I would create an App Rule called "High Query Count" where "Query Count = 50-u", alert on this in Risk.Warning, for example. Then you will be able to write Informer reports that reference that rule... for instance you could detect the top 30 Alias Hosts where Risk.Warning = High Query Count.