How to report on event and linked alert ?

MathieuJM

Hi,

We like to have a report that can join an event and the alert that has been generated.

i don't see a clear link/relation between the events table and the alerts table ether in SWQL or SQL.

Has anyone been already able to link these values ?

Cheers

Find more posts tagged with

alert_report

event_report

report

Accepted answers

All comments

KMSigma.SWI

I think this covers most of the things you are looking to do..

MathieuJM

Thank you @KMSigma.SWI. I will look at this in order to create a whole report for all alerts or at least all alerts during a specific time range.

Do you know if there are any enhancement in order to track more easily the event that have trigger an alert ?

KMSigma.SWI

You'd have to check the Orion Platform Feature Requests. My guess is that there is not. Because of the one-to-many relationship between the two element types (Alerts [one] to Event Log [many]) it's not a trivial thing (as you've no doubt seen from my linked article. If you feel that this would be beneficial for the product, please create a support request. If you need help for a Feature Request, there's a THWACK Tuesday Tip video about it.