When using orchestrator, a lot of activities contain a filter
Get Alert / Monitor Alert is some of them.
The following workaround is tested for the above 2 activities, but i think it does apply to other filter activities too. (have not had the time to test yet, comments are welcomed!).
I ran into an unexpected behavior today:
I was using a filter saying “TicketId Does not equal No Automatic Escalation”, and i was expecting to get alle alerts that did not have this text in the field.
but I did not get all of them!. I only got the ones that did have a value and not the ones that had nothing in TicketId (which was the alerts i wanted).
so it seems that this filter does it work when the filtering property has the value “nothing” also known as NULL.
i had to rethink my solution, and i figured that any alert that was New and had nothing in TicketId would be the ones i need.
So i changed the filter to get the empty ones.
You can do this by filtering on the text NULL
Enjoy!
Security Monitor Screen Filter
[…] s, but i think it does apply to other filter activities too. (have not had the t […]