Disable Noisy message ID

[RSAAdmin]

Hi ..

We have one corelation rule for device Cisco switch ; and selected  some event category ...I want to disable single message ID from that event category but dont want it do it from rule...I dont want that message id should fire any alerts..any sugeestion.

[CharlesBeierle]

Can you post the correlation rule's XML and what message ID you don't want to cause the firing action? I believe it to be as simple as adding a filter but seeing the rule would help a lot.

[RSAAdmin]

I think the best way is to move away from category and just select the message IDs that you want to include in the alert.  If you go the filtering route, you would have to filter out specific text from the [CONTENT]  of the message.  I think this is inefficient.  It is better to just look at the category in manage messages and select all of the message IDs that you want to include, esp. since it is just a matter of checking multiple boxes.

Paul