It seems like there's a large number of ways that Alerts and Actions in Orion can be set up where they don't actually do anything.
Examples: Enabled alert config/definition with all actions disabled. Action with no ActionAssignment, Action that is only assigned to a disabled Alert config, impossible scheduling, email actions with no valid destinations.
I'm sure I'm missing more ways.
I'm looking for any suggestions or guidance on finding these "effectively disabled" alerts and actions so I can remove them from my Orion environment. I've inherited a mess and been left to sort out what was dumped on my lap into a useful monitoring/reporting tool, as it isn't currently. Less noise to sort through will make analyzing and consolidating the rest easier.
So far I've been using SwisPowerShell to grab and push data, so SWQL queries and Powershell is extra appreciated.
Sidenote: I've been trying to figure out the relationships between Actions, ActionAssignments, AlertConfigurations, and AlertDefinitions.
Want to confirm if this is right: 1 Action -> Many ActionAssignments. Many ActionAssignments -> 1 AlertConfiguration. 1 AlertConfig <-> 1 AlertDefinition.
Thanks in advance!