XSIAM Alert Exclusions - Time lapse to apply actions upon using 'Create Alert Exclusion Rule'

[john-lillington]

Hi is there any specific guidance or information relating to how long it can take to apply 'auto-resolve' after creating an Alert Exclusion  filter rule using XSIAM > Exceptions > Alert Exclusions when using the setting 'Apply rule On Existing Alerts' ?

[chris1058 · Accepted solution]

Hello, @john-lillington nystateofhealth

When you create an Alert Exclusion filter rule in XSIAM using the setting 'Apply rule On Existing Alerts', the time it takes for the 'auto-resolve' to apply can vary depending on several factors, including the number of existing alerts and the system's current load. Generally, this process should be relatively quick, often completing within minutes, but for a large volume of alerts, it might take longer. If you experience significant delays, it might be helpful to consult XSIAM documentation or contact support for more specific guidance.

I hope this will help you

Best regards

chris wright