ESA Rule- How to avoid reiteration of notification in console
For the ESA Rule is there an option not to create additional notifications for certain time post first notification. For example lets take an alert logic where the requirement is to alert multiple failed login attempted by User A for 5 times in 2 minutes where in I could create rule logic but could not restrict in such a way that once alert has triggered alert for same user should not be triggered for say next 6 hours.
Any suggestions is much appreciated.
Varun P G
- Community Thread
- ESA Rules
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform