+10My team is considering increasing the max number of alerts that can be grouped together in a case- I think Google has increased it at some point to now be a max of 90.
I will do testing of this before making any changes, but has anyone seen any impacts that arent immediately obvious when making this kind of change?
+19It can affect performance and latency for sure. It has to wait longer to group together, which has downstream affects such as slower playbook response.
But of course, monitor for several days or trend upward from a grouping perspective over a specific period of time. For example, change to 45, monitor and then move on to 60, 75, 90. But if you have that many alerts in one case, maybe the correct place to look is at the rule itself.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
