AIOPS Help

[SonnyHerriott]

Hi,

I am new to AIOPS (we are using free version and appears we are upgraded to the Strata interface) and trying to get it configured within our environment but experinecing a few issues.

1. Assignees

I don't seem to be able to assign any alerts to other members of my team which have signed in to our instance. I only see myself, is there something I need to do to open this up to my team? I've checked the settings etc. and cannot see anything obvious.

2. Alerts

I have an alert for delete disabled rules and configured notifications on that alert, we are not getting these emails and we have disabled rules. This is from our NGFWs which are using Panorama. NGFWs and Panorama all have telemetery enabled and are feeding into AIOPS but we are getting nothing back.

3. Alerts 2

Health alerts seem more stable but we still have an active alert for running a PAN OS version which had a vulnerability 10.1.9. We upgraded to 10.2.4 back in June but that alerts is still there and active, it hasn't cleared. Assuming this should clear and I don't need to acknowledged / resolve the alert manually?

I have logged a request with our support to look into these issues but was hoping someone could also help here.

Thanks!

I have an alert for 

[svenkatarama]

1. The restriction of Assignees to the current user is a known issue. We are working to expand that and also have this be assigned with the Service Now integration. 
2. The Alert notifications are not retrospective - they trigger emails from that point forward when new Alerts are generated. Do you have any new Alerts of that type? (I suppose you have already checked out some other Alert notification emails to the same email address do arrive?)
3. Yes, these should clear automatically. Is the device actively sending telemetry (the hourglass icon beside it will tell you that information)? If that checks out OK, I think there is a bug. 

[SonnyHerriott]

Hi,

1. Thanks, that explains that one!

2. We have no alerts of this type, I am about to disable over 10 rules today so will serve as another test.

3. We are running 10.2.4 on the 5220s and Panorama, I believe telemetery is enabled by default from this version. Palo had to make a backend fix to our instance of AIOPS recently as we only had health information displaying from the 5220s. We now see security information but the alerting is not working from these devices and there are inconsistencies. We are receiving alerts for other devices we are using which are not using Panorama from the same instance of AIOPS so I know the config of mail addresses etc. is good.

I only have RBAC access to the devices as the firewalls and Panorama are managed by a 3rd party so I cannot see all the menus based on my access.