XSIAM Alert Exclusions - Time lapse to apply actions upon using 'Create Alert Exclusion Rule'

john-lillington — Thu, 27 Jun 2024 08:33:59 GMT

Hi is there any specific guidance or information relating to how long it can take to apply 'auto-resolve' after creating an Alert Exclusion filter rule using XSIAM > Exceptions > Alert Exclusions when using the setting 'Apply rule On Existing Alerts' ?

Re: XSIAM Alert Exclusions - Time lapse to apply actions upon using 'Create Alert Exclusion Rule'

chris1058 — Fri, 28 Jun 2024 05:23:50 GMT

Hello, @john-lillington nystateofhealth

When you create an Alert Exclusion filter rule in XSIAM using the setting 'Apply rule On Existing Alerts', the time it takes for the 'auto-resolve' to apply can vary depending on several factors, including the number of existing alerts and the system's current load. Generally, this process should be relatively quick, often completing within minutes, but for a large volume of alerts, it might take longer. If you experience significant delays, it might be helpful to consult XSIAM documentation or contact support for more specific guidance.

I hope this will help you

Best regards

chris wright

topic XSIAM Alert Exclusions - Time lapse to apply actions upon using 'Create Alert Exclusion Rule' in Cortex XSIAM Discussions

XSIAM Alert Exclusions - Time lapse to apply actions upon using 'Create Alert Exclusion Rule'

Re: XSIAM Alert Exclusions - Time lapse to apply actions upon using 'Create Alert Exclusion Rule'