Question

Alerts repetation

  • 23 February 2024
  • 1 reply
  • 31 views

Userlevel 1

Hi,

I would like to know if is it possible to receive one alert for the same action? For, example : for the following example if the same action is repeated several times I want to recive just one alert not more.

 

action=Login source_address=1.1.1.1 user=titi | chart count() by user

 

Is it possible ? If yes could you please tell me how do I do ?

 

Best regards,

SA


1 reply

Userlevel 4
Badge +8

Play around with “flush on trigger” and alert throttling :)

Reply