More Alert intelligence
Some interem space should be created between "real time" and the History of alerts. It is my understanding that once the alert is moved to history nothing can be done with it other than reporting. This buffer space should not be affected by "alerter service" restarts. We have some technical issues with Triage so we are relying on the alert responses and resolutions to close alerts. It is very frustrating to go and look for an alert and all I can do is create a report... I want to take action on that alert that is not necessarily real time but needs more than just a "history" report.
If you go into Alert History which is populated within a minute from the alert firing...you can change the status of that alert from New to either Resolved or Under Investigation and you can put in notes about the resolution.