Hello, Is there a way in which you can generate reports/dashlets based
on the root event(s) that caused an alert?Rules using Respond DB as a
source will not help since they are lacking in granularity. I want to
generate some rules that will take the ...
I have a set of events, each with multiple instances of the same meta
key "action" with three unique and a number of same values. Is there a
way to alert when one such event has a number of same values greater
than x? Example, in a FTP session action...
Hello,I have come with a, in my opinion, more universal solution for
this problem and i would like your thoughts for this.I have made ESA
forward the sessionid of the root events in the alert and then i am
taking those root events, putting them in a ...
Thank you for your reply.I had this option in mind. I was hoping there
would be a better way than creating a syslog template for almost each
ESA alert, since some alerts require information gathered from multiple
events and you will need multiple tem...
Thank you, I tought i might be able to do this with an app rule or
correlation rule. I also tought that ESA would be the way to do it but
your solution is prettier than mine.
