10-10-2023 06:15 AM
Greetings to everyone. I have an incident with several alerts. While looking at the incident closely, the "Exclude Alert" and "Investigate Causality Chain flyout appeared, and I unintentionally clicked on "Exclude Alert".
According to the logs, I have now "Successfully excluded alerts with id= 12345678"
I need to undo this action, but I don't know where it would be. I can't find a rule in IOC, BIOC, or Action Center.
If I can't remove the "exclude alert", then I need to know what I actually changed. Was it to alert on a specific ID? Am I likely to see that ID appear again in the future?
10-10-2023 07:19 AM
Hi Eric_Geater,
When you right-click on an alert and click Exclude Alert, you are performing a one-time action to exclude that single alert. It does not affect future alerts or any other existing alerts, nor does it create any rule in your Exceptions Configuration page. You can still find the alert within the incident (though, if you exclude the last open alert in an incident, the incident will be automatically closed and may be removed from your Incidents page, depending on your filter configuration).
The easiest way to undo this is by opening the incident (again, you may need to update your Incident page filters), open the Alerts and Insights tab, right-click on the alert and select Undo Alert Exclusion. If the incident is currently closed, it will automatically reopen the Incident as well.
10-10-2023 07:19 AM
Hi Eric_Geater,
When you right-click on an alert and click Exclude Alert, you are performing a one-time action to exclude that single alert. It does not affect future alerts or any other existing alerts, nor does it create any rule in your Exceptions Configuration page. You can still find the alert within the incident (though, if you exclude the last open alert in an incident, the incident will be automatically closed and may be removed from your Incidents page, depending on your filter configuration).
The easiest way to undo this is by opening the incident (again, you may need to update your Incident page filters), open the Alerts and Insights tab, right-click on the alert and select Undo Alert Exclusion. If the incident is currently closed, it will automatically reopen the Incident as well.
10-10-2023 01:41 PM
Afurze, perfect, thank you! That worked quite nicely.
Also, for the record, I was reviewing the case, logs, and rules for nearly thirty minutes, trying to find the instance of my change. It turns out that it took much longer for the "exclude" to actually take place.
By the time I looked again just now, it was clear and easy to find in the incident, just like you said. Thank you!!!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
