Setting event thresholds lets you tailor the frequency of automatic responses to fit the needs and realities of your environment.
Aggregation
Use aggregation to set the number of events that occur before triggering an automatic response.
For example, you can configure an automatic response rule to send an email message based on the thresholds you select. First, set the Trigger this response if multiple events occur within: field to 30 minutes.
Next, select an option:
Option 1 — Select When the number of distinct values for an event property is at least a certain value.
When Property: is set as Agent GUID and Number of distinct values: is
10, the response is triggered when 10 unique GUIDs report this event in 30 minutes.Option 2 — Set the When the number of events is at least: count to
10.The response is triggered if 10 event IDs are reported within 30 minutes. The response is triggered whether a single computer reports 10 events or multiple computers trigger the total number of events.
Grouping
Use grouping to combine multiple aggregated events. For example, events with the same severity can be combined into one group. Grouping provides these benefits:
Respond to all events with the same or higher severity at once.
Prioritize events that are generated.