Edit triggers

Security Requirements and Controls

  • Update triggers permission

Edit existing triggers as needed to adjust properties.

Note

You cannot switch between trigger types once the trigger is created. To recreate a trigger as a different type, duplicate the trigger and change the type. For more information, see Duplicate Trigger.

  1. Go to the Automation tab to see the full list of triggers saved in the repository or view.

  2. Click on the name of the trigger to edit.

  3. Change the properties in the Trigger details panel — for example, you can add a description of the trigger or change the time window. For the full list of the properties that can be modified in an existing trigger, see Trigger properties.

  4. To edit the current trigger query, click Edit in search page:

    Edit Query

    Figure 199. Edit Query


  5. Select fields or refine your query in the Search page (Editing trigger mode) after being redirected.

    The Time Selector will maintain the timestamp you selected in Advanced settings as the default time field, ensuring consistent results.

    Screenshot showing the UI Editing trigger mode

    Figure 200. Edit Query from the Search Page


  6. Click Save to save the new query, or Discard changes to cancel any edits you have made. Saving the edited trigger will create and, if necessary, restart the alert query.