Okay, I'm not sure if anybody else has noticed or experienced this - but the 'Occurs' count for an RSA SA ESA rule has a limit of 100!
Is this true?
I've set the 'Occurs' to count 150/200/500 events, but the alert is always generated on 100 events. Is this a known quirk, or something unknown or unique to my environment, for some reason?
If I go below 100, to about 90 - it works proper, counting only 90 occurrences.
Let me know if anybody's experienced this, or if it has a workaround.