You can configure alerts or automatic responses to receive a notification when data congestion begins for your environment.
To receive a notification when congestion begins for your setup, you can configure an alert for the Data Congestion Detected event. Similarly, to receive a notification when data is deleted from the ePO - On-prem database to resolve congestion, you can configure an alert for the Clogged Data Deleted event.
Select Menu → Automation → Automatic Responses.
Click Actions → New Response, then enter the alert name.
Select the ePO Notification Events group and Threat event type.
Select Enabled, then click Next to open the Filter page.
Select My Organization for the Defined at property, then Select Threat Name from the Available Properties pane.
Include this information in the Value field:
Type
DATA_CONGESTION_DETECTEDand click +.Type
CLOGGED_DATA_DELETEDand click Next.
Specify aggregation details, then click Next to open the Actions page.
Select Send Email, specify the email details, and click Next to open the Summary page, then review the details and click Save.