From the Incidents page to the Alerts table, can you use/share those filters to make Automation rules?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

From the Incidents page to the Alerts table, can you use/share those filters to make Automation rules?

L0 Member

I have created some filters (via the Alerts table) while doing some investigations. It ended up being useful and needing an automation rule. However, when I went to the automation page and looked at the filters, they were blank. I shared the filters within the Alerts table, and they still weren't there. 

 

Is there a way to share/Import or copy these filters from the Alerts table to the Automation Rule filters? I tried copying the data from the filter but that didnt work and it would be a pain to copy the whole thing again, making me do the work twice.

 

Thank you

2 REPLIES 2

L0 Member

@A.Dusciodry needling wrote:

I have created some filters (via the Alerts table) while doing some investigations. It ended up being useful and needing an automation rule. However, when I went to the automation page and looked at the filters, they were blank. I shared the filters within the Alerts table, and they still weren't there. 

 

Is there a way to share/Import or copy these filters from the Alerts table to the Automation Rule filters? I tried copying the data from the filter but that didnt work and it would be a pain to copy the whole thing again, making me do the work twice.

 

Thank you


To transfer filters from the Alerts table to Automation Rule filters, you need to:

  1. Export the filter configuration from the Alerts table (if supported).
  2. Import or manually recreate the filters in the Automation Rule section.

Unfortunately, direct copying or automatic sharing of filters between different sections might not be supported. Check if Palo Alto Networks provides any specific tools or documentation for migrating or sharing filters between modules.

L0 Member

Thank you for the reply. It doesnt appear to be supported, which is absurd IMO. Its all the same fields, they just didnt think about adding that in. Thank you for your help and if you find another way at some point, please let me know.

  • 352 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!