More Alert intelligence

Discussion created by GWGUNTER on Jul 12, 2010
Latest reply on Jul 24, 2010 by RSA Admin

Some interem space should be created between "real time" and the History of alerts.  It is my understanding that once the alert is moved to history nothing can be done with it other than reporting.  This buffer space should not be affected by "alerter service" restarts.  We have some technical issues with Triage so we are relying on the alert responses and resolutions to close alerts.  It is very frustrating to go and look for an alert and all I can do is create a report...  I want to take action on that alert that is not necessarily real time but needs more than just a "history" report.