Snooze alerts for later analysis
Snooze alerts when they are of lesser priority, as compared to other alerts, allowing you to focus on more critical alerts while preserving lower-priority alerts for future analysis.
This task is part of a workflow defined in Alerts based on firewall events.
For example, if your organization is repurposing an email server as an FTP server, and the system generates an Emergent Profile alert (indicating that an entity's current traffic matches a behavior profile that it did not previously match), you can snooze this alert as it is intended behavior, and revisit it at a later date. A snoozed alert does not show up with the open alerts; you must specifically filter to review these snoozed alerts.
Follow these steps to snooze an alert:
Procedure
Step 1 | Click Close Alert. |
Step 2 | In the Snooze this alert pane, select a snooze period from the drop-down. |
Step 3 | Click Save. When you are ready to review these alerts, you can unsnooze them. This sets the status to Open, and displays the alert alongside the other Open alerts. Unsnooze a snoozed alert:
|
The alert is snoozed for the selected period and removed from the active alerts view until the snooze period expires or you manually unsnooze it.