Clicking "Exclude Alert" in an incident does... what, exactly?

[Eric_Geater]

Greetings to everyone.  I have an incident with several alerts.  While looking at the incident closely, the "Exclude Alert" and "Investigate Causality Chain flyout appeared, and I unintentionally clicked on "Exclude Alert".

According to the logs, I have now "Successfully excluded alerts with id= 12345678"

I need to undo this action, but I don't know where it would be.  I can't find a rule in IOC, BIOC, or Action Center.

If I can't remove the "exclude alert", then I need to know what I actually changed.  Was it to alert on a specific ID? Am I likely to see that ID appear again in the future?

[afurze · Accepted solution]

Hi Eric_Geater,

When you right-click on an alert and click Exclude Alert, you are performing a one-time action to exclude that single alert.  It does not affect future alerts or any other existing alerts, nor does it create any rule in your Exceptions Configuration page.  You can still find the alert within the incident (though, if you exclude the last open alert in an incident, the incident will be automatically closed and may be removed from your Incidents page, depending on your filter configuration).

The easiest way to undo this is by opening the incident (again, you may need to update your Incident page filters), open the Alerts and Insights tab, right-click on the alert and select Undo Alert Exclusion.  If the incident is currently closed, it will automatically reopen the Incident as well.

[Eric_Geater]

Afurze, perfect, thank you!  That worked quite nicely.

Also, for the record, I was reviewing the case, logs, and rules for nearly thirty minutes, trying to find the instance of my change.  It turns out that it took much longer for the "exclude" to actually take place.

By the time I looked again just now, it was clear and easy to find in the incident, just like you said.  Thank you!!!