Hi Brian,
Remember that even Correlation (Threshold) Alerts are always built to take action based on the results of a query. I always like to think of them like this:
"Every
N minutes (
run frequency), run the
Query looking back over the past
N minutes (
Accumulation interval which can also be read as "NOW -N Minutes"). If the results of the whole query (
per report) or any line in the query result (
per line) is more than
N (
Threshold) then send a message to the defined Alert Receivers every
N minutes (
Notification frequency).
The Query that you use to power the Alert must have some kind of counter/metric involved. So a total number of failed logins (with a Count that you added in the Query Builder) or a Total Disk Used (that you include as an Attribute in the Query) or something of the sort.
Does that help or make it worse? Let us know!
Matt
------------------------------
Matt Simons
------------------------------