Analytics BIOC Rules Incidents

[Marco.Dermitzakis]

Hello,
By checking a specific Analytics BIOC Rule, I see that it has created several alerts in the past. Some of these alerts have been associated to an incident id. These incidents contain only that specific alert and no insights.

Why the specific BIOC rule has created incidents while in other cases it did not ?

[dbahuguna]

Hi @Marco.Dermitzakis 

Thank you for reaching out to Palo Alto Live Community.

With respect to your query why the specific BIOC rule has created incidents while in other cases it did not, some of the BIOC rules generate low severity or the informational alert and some of the rules generate high or medium severity alert, and the low or informational alert are not part of the incident whereas the high and medium severity alert are part of the incident. That is the reason some of the BIOC rule alert are part of the incident and some of them are not.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[Marco.Dermitzakis]

hi @dbahuguna, 

thank you for your answer. Unfortunately this does not answer my question though.
The same ABIOC rule (First successful VPN access from a country in organization), is not creating incidents any more. All alerts generated in the present and past are marked as Low severity.
So my question is why it created incidents since July and why not afterwards?

Did PA perhaps changed the severity attribute for this ABIOC?

 

[dbahuguna]

Hi @Marco.Dermitzakis 

As, this is with respect to an alert or incident with which you require assistance and it seems it require further investigation, as this is a public discussion forum my suggestion would be to refer to your Customer Success team or TAC by opening a ticket through our support portal

Feel free to write back if you have further query.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.