Reviewing Filter Activity

Every time Global Alert Filters evaluate an alert, the outcome is recorded in the "Global Alert Filter Usage" page, located under Activity and Logs > Global Alert Filter Usage.

Here you will see a complete history of what your rules did. Activity is retained for a configurable window (30 days by default) that you may adjust in the Global Default Rule dialog. Older entries are pruned automatically.

From the Usage view you can see a complete list of rules that have been used. This will allow you to tailor your experience using Global Alert Filters, including:

• Confirm a new rule is working by watching the alerts it matches after you enable it

• Investigate over-filtering if an alert you expected to see never arrived

• Find expression errors and broken rules

The Usage Page records one entry per rule evaluation, not one per alert. A single alert that was evaluated against four rules before matching the fourth will produce four entries.

Rules that are not applied because their scope did not cover the alert (e.g. the alert had the wrong ingest source or wrong tenant) are not evaluated and produce no log entry.

The Global Alert Filter Usage Page

At the top of the page there is a timeline of activity. Below is a record of all evaluations that have occurred.

Logs are sorted according to the following characteristics:

• Evaluation: the evaluation's ID. Select it to open the full details of that evaluation

• Date: the date the evaluation ran

• Source: the alert source the alert arrived from

• Result: the outcome of the evaluation

• Rule: the name of the rule that was evaluated and its CEL expression

• Alert: the raw data of the alert that the evaluation was run against

You may filter logs by Date, Source, Result, and Rule by using the respective dropdowns at the top of the page.

The Global Alert Filters Usage Page

Evaluation Results

There are five possible outcomes to an evaluation:

• Match ➔ Include: the rule matched and the alert was kept for investigation. Evaluation stopped here

• Match ➔ Skip: the rule matched and the alert was suppressed. Evaluation stopped here

• No Match: the rule was evaluated and did not match. Evaluation continued to the next rule

• Error: the rule's expression could not be evaluated. It was treated as not matching, and evaluation continued to the next rule

• Default Include/Skip: no rule matched, and the Global Default Rule was applied

If an error entry occurs, be sure to check its CEL expression for any mistakes. If you still experience errors, engage your Dropzone AI support representative.

Depending on your rule configuration, a skipped alert may have a skip reason attached.

You may view the complete log details by clicking on an Evaluation ID.