Who rated this post

Hello, @john-lillington nystateofhealth

When you create an Alert Exclusion filter rule in XSIAM using the setting 'Apply rule On Existing Alerts', the time it takes for the 'auto-resolve' to apply can vary depending on several factors, including the number of existing alerts and the system's current load. Generally, this process should be relatively quick, often completing within minutes, but for a large volume of alerts, it might take longer. If you experience significant delays, it might be helpful to consult XSIAM documentation or contact support for more specific guidance.

I hope this will help you

Best regards

chris wright