AnsweredAssumed Answered

SA IM Rules that are NOT part of Incident - How to generate reports

Question asked by Hari Rumbay on May 3, 2017

We have an scenario where the ESA Alerts are firing and respective hit counts are being to know to us  .  We would to get into the metrics of how many such fired alerts are not making into the Archer through SA IM . Basically we need the CLI method on how to get the SA IM Rule name that are NOT PART OF INCIDENT  in handy format . currently GUI has an option but the page counts are too high . ( No Export / Graph options are available ) . 

Outcomes