One of the questions I am often asked when working with customers is why AEDA monitors notifications/alerts say that there is no event for an action (when it is required for the action to be detected) yet when looking at the job, there are events associated with the job/action. There’s a simple solution for this, but first we need to look to see how AEDA works.
AEDA runs jobs on a regular schedule and waits to see if the results of that job meets criteria set by the user. An example timeline might be like the following:
Notice that the AEDA interval is not the full query interval, necessarily. The default setting is for 900 seconds (15 minutes). In some environments, we may lengthen the query interval for technologies (especially the SIEM) beyond that time. If events show up after the AEDA Interval, MSV ignores them for the purposes of AEDA alerting.
The fix? If you do not have a requirement that an event makes it to the system within a given set of time, change the following setting to match the longest period of your query interval for integrations (assuming it doesn’t exceed 1 hour):
This setting is located in Settings → Director Settings → Advanced.