As we continue to grow our Orion monitoring environments across data centers, the limitations of some of the tools and interfaces within the product suite begin to become more problematic.
One such case is the legacy Advanced Alert Manager, within which I am forced to spend long hours during while reviewing and migrating rules into new instances of Orion we are building out.
The existing alert import/export tool does not appear to support exporting/importing more than one rule at a time.
Additionally; the existing utility does not even capture the alert rule name as the file name to export & save, so the user must capture the alert rule name in the cut/paste buffer (after opening the rule in the editor), then paste that name into the file save-as dialog during export.
This action is not conducive to use of the tool to manage large quantities of rules in one session, rendering the utility wholly ineffective for use in any large-scale actions like migrating copies of production alert rules into another instance of Orion.
I would love to see an updated rules editor that includes the ability to export and import rules en-masse, with the export function enhanced to pull the rule name from the rule and paste it into the save-as dialog as a default file name.
Upon import, the utility could be configured to either overwrite any existing rule by the same name, or append a unique suffix onto the rule name to make it intuitive to the admin as to which version was the new (imported) one.
Lastly (and this is a big one too); the ability to search and replace data within rules in the alert manager; allowing for mass edits when multiple rules need a customer property name change in the filter statements or an email distribution list changed in the recipient list of email actions, etc.
Being able to do this without resorting to some nasty hack of the database would be a huge help when trying to manage changes to large alert rule stacks on multiple instances of Orion.
