Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
10-18-2023 02:56 AM - edited 10-18-2023 03:08 AM
Hello,
By checking a specific Analytics BIOC Rule, I see that it has created several alerts in the past. Some of these alerts have been associated to an incident id. These incidents contain only that specific alert and no insights.
Why the specific BIOC rule has created incidents while in other cases it did not ?
10-19-2023 12:58 AM
Thank you for reaching out to Palo Alto Live Community.
With respect to your query why the specific BIOC rule has created incidents while in other cases it did not, some of the BIOC rules generate low severity or the informational alert and some of the rules generate high or medium severity alert, and the low or informational alert are not part of the incident whereas the high and medium severity alert are part of the incident. That is the reason some of the BIOC rule alert are part of the incident and some of them are not.
Hope this helps!
Please mark the response as "Accept as Solution" if it answers your query.
10-19-2023 01:42 AM
hi @dbahuguna,
thank you for your answer. Unfortunately this does not answer my question though.
The same ABIOC rule (First successful VPN access from a country in organization), is not creating incidents any more. All alerts generated in the present and past are marked as Low severity.
So my question is why it created incidents since July and why not afterwards?
Did PA perhaps changed the severity attribute for this ABIOC?
10-19-2023 05:39 AM
As, this is with respect to an alert or incident with which you require assistance and it seems it require further investigation, as this is a public discussion forum my suggestion would be to refer to your Customer Success team or TAC by opening a ticket through our support portal
Feel free to write back if you have further query.
Hope this helps!
Please mark the response as "Accept as Solution" if it answers your query.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
