AnsweredAssumed Answered

ESA Rule Builder - 'Occurs' count quirks

Question asked by Visham Rawat on Oct 11, 2018
Latest reply on Oct 11, 2018 by Mohammed Mustafa

Okay, I'm not sure if anybody else has noticed or experienced this - but the 'Occurs' count for an RSA SA ESA rule has a limit of 100!

Is this true?

 

I've set the 'Occurs' to count 150/200/500 events, but the alert is always generated on 100 events. Is this a known quirk, or something unknown or unique to my environment, for some reason?

 

If I go below 100, to about 90 - it works proper, counting only 90 occurrences.

 

Let me know if anybody's experienced this, or if it has a workaround.

Outcomes