AnsweredAssumed Answered

Informer alert question

Question asked by Thomas Schaub on Jul 21, 2013
Latest reply on Jul 26, 2013 by RSA Admin

Hello All -


Running Informer and would like to create an alert only when a certain event exceeds a threshold.  For example HTTP GET sessions to a Web server is greater than x/per minute.  I've tried using the 'min_threshold' rule action, but the alert still fires even when x is less than the min_threshold value.  Am I taking the right approach?  Any/all thoughts/insights appreciated.  Tnx, Tom