Editing Alerts
Security Requirements and Controls
Change triggers and actions
permission
Existing alerts can be edited or modified.
To edit an existing alert:
Go to the
tab to see the full list of alerts saved in the repository.Click on the name of the alert to edit.
Change the properties in the Properties panel on the right — for example, you can add a description of the alert or change the time window. For the full list of the alert properties that can be modified in an existing alert, see Alert Properties.
To edit the current alert query, click Query:
underFigure 191. Edit Query
You are redirected back to the
Search
environment in Editing alert mode, where you can select fields and refine your query.Figure 192. Editing Query from the Search Page
Note
Pay attention to the type of alert you're editing the query for: if it's an aggregate alert type it requires an aggregate query, and won't work if you change it to a filter query.
Click
to save the new query, or to cancel any edits you have made.When you've done editing the alert, click
on the bottom right of the panel: saving the edited alert will create and, if necessary, restart the alert query.
Note
You cannot switch between alert types once the alert is created. To recreate an alert as a different type, you will need to copy the query to a new alert.