Analytics BIOC Rules Incidents

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Analytics BIOC Rules Incidents

L1 Bithead

Hello,
By checking a specific Analytics BIOC Rule, I see that it has created several alerts in the past. Some of these alerts have been associated to an incident id. These incidents contain only that specific alert and no insights.

 

Why the specific BIOC rule has created incidents while in other cases it did not ?

 

 

3 REPLIES 3

L2 Linker

Hi @Marco.Dermitzakis 

 

Thank you for reaching out to Palo Alto Live Community.

With respect to your query why the specific BIOC rule has created incidents while in other cases it did not, some of the BIOC rules generate low severity or the informational alert and some of the rules generate high or medium severity alert, and the low or informational alert are not part of the incident whereas the high and medium severity alert are part of the incident. That is the reason some of the BIOC rule alert are part of the incident and some of them are not.

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

 

hi @dbahuguna

 

thank you for your answer. Unfortunately this does not answer my question though.
The same ABIOC rule (First successful VPN access from a country in organization), is not creating incidents any more. All alerts generated in the present and past are marked as Low severity.
So my question is why it created incidents since July and why not afterwards?

Did PA perhaps changed the severity attribute for this ABIOC?

 

L2 Linker

Hi @Marco.Dermitzakis 

 

As, this is with respect to an alert or incident with which you require assistance and it seems it require further investigation, as this is a public discussion forum my suggestion would be to refer to your Customer Success team or TAC by opening a ticket through our support portal

 

Feel free to write back if you have further query.

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

  • 849 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!