Skip to main content


Hello All,


what are the "Alerts Grouping" options for Carbon Black products which works best according to your experience??


Currently for me it makes too many "Overflow Cases".


would appreciate some hints and pointers



best regards


Mohammad


hey
@Mohammad_Sulaim
can you please elaborate on your use case? What connector do you use? im just wondering that alerts grouping might not be related to the overflow here



did you had this issue when you first started to use the connector or is it happenning regularly?



from the start its happening, so I have disabled the connector currently and whenever I enable it, its still happening.



@Dmitry_Sarakeev



i guess what is happening that initial "burst" of alerts coming from the CB side that causing the overflow... you can try to increase the schedule of every connector run and as well decrease the number of alerts fetched from CB per every connector run



@Dmitry_Sarakeev
seems to be working so far, would give it some times and see what happens.
thanks


Reply