Skip to main content

Hi,

I would like to know if is it possible to receive one alert for the same action? For, example : for the following example if the same action is repeated several times I want to recive just one alert not more.

 

action=Login source_address=1.1.1.1 user=titi | chart count() by user

 

Is it possible ? If yes could you please tell me how do I do ?

 

Best regards,

SA

Play around with “flush on trigger” and alert throttling :)


Reply