2022-11-13 11:53 PM
Could anyone share a real-world example of using alerts generated from the reporting engine?
I'm trying to think of a use case that couldn't be achieved through app rules or ESA?
2022-11-30 04:25 AM
If it is just a simple query without correlation needed, looking for something on a single event source, then a Reporting Alert would work.
The same thing could be done on ESA.
I have some customers using the query for the alert not directly in the reporting engine, but putting it into an APP Rule, updating e.g. alertid and then just querying the alertid.
That speeds up query time.
And it gets load away from ESA. And that's the only Use Case, why i would do that.
2023-04-07 10:50 AM
Well, the reporting engine will also allow you to reference a list you have created. That same list can't be referenced from the ESA or an app rule. You could, for example, create a blacklist of URL's, write a rule in the reporting engine and reference that list and have it fire off an email when its triggered. Unless its changed, a list in the reporting engine was efficient up to 100 items, then it would be better to just create a feed, create separate meta for what you're alerting on and meta from the feed can be alerted on in other modules.