Hi All,
I Came up with a weird issue where i checked for data for past 1 hour and found the Alerts are mismatching across different windows.
Like in SIEM Search can see only 13, under ALERTS AND IOCs - 300+ and when did retro-hunt its also different.
Does anyone have idea why it might happen?
Difference in Alerts count
+8- Bronze 1
Hi,
Alert discrepancies in SecOps can stem from time range mismatches, RBAC restrictions, filter settings, data ingestion delays, search logic, differing rule logic, or variations in retro-hunt data.
I suggest using the direct way to view alerts in SecOps:
Go to Detection > Alerts and IOCs — this page lists all current alerts.
*Make sure the selected time range matches your expectations, and remove any active filters to see all alerts.
+10Doing retrohunts is likely to change the alerts count as well since new data (raw logs/UDM events) might be available for the rule to create detections. it is also possible, that the data changed due to enrichment and hence more detections are created. A new rule version may also create additional alerts.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.