ProfessorProfessorOn 1/4/2021 at 3:23 PM, Stuart Weenig said:There have been some conversations around adding an occurrence counter to alerts. This would increment an existing alert if another violation happens while the previous alert is still open. Mostly around event sources; if you get 12 traps about the same thing, open one alert with a count of 12 instead of 12 alerts.
The same thing could be extended to this, but something would have to define whether the existing closed alert would be reopened/incremented or a new alert opened. Probably could be as easy as "for this instance, within X minutes of opening/closing, increment instead of opening a new alert".
What we would prefer is a simple manual options to pin the alert so that if it reoccurs and the alert is already pinned then the count on the pinned alert is incremented. When an alert is unpinned, then the process reverts to normal method of creating and clearing alerts as per DS definition.
