I upgraded to Orion v12.0 from 11.5 "recently" and the upgrade brought in all my existing alerts and actions. Most of my alert actions were just copies from existing alerts(in v11.5). Now I'm in v12.0, It looks like you can assign individual actions to alerts ( i.e. one action to many alerts, or 1 alert to many actions) This is cool, as I could now conceivably make about 10 generic alert actions,cut over my alerts to use them, then "remove" all the hundreds? billions? of duplicate alert actions from the action manager that were generated during the upgrade process....but...there is no "Create new alert action" button in the alert action manager?
- Good: I can create a new alert, and during that process I can create new actions tied to the alert. This appears to be where the missing "create new action" button is...but only inside an existing alert can I get to it, not at the level of the" action manger".
- Good: I can reassign existing actions (that are tied to existing alerts) to other alerts (if I needed to). This seems odd though as I could make a mess associating everything together, esp. if I needed to delete the alert holding the original copy/instance of a highly associated/shared/linked alert action.
- Impossible?: I cannot seem to just create a standalone "generic" alert action that's not associated with any existing alert, and then associate alerts to that action at a later time.
If I make a copy of an alert with existing actions it copies the actions, but then if I delete the (copied) actions in that (copied) alert, it actually deletes the (copied) actions, it does not "unlink" them from the (copied) alert. <- Sorry. that's hard to read 
It seems the only way to sort of create reusable alert actions is to create a "generic alert" you don't ever turn on, then create the "generic alert action action" you want to share, then disable the alert as it's only role is to allow the alert action to exist. In fact, if I were to have the need to route many alerts to a secondary system, it seems like I would want to create a single generic alert (call it "Send to XYZ system. Never enable this rule as it holds all alert actions for system XYZ") and then create all of the alert actions for that XYZ system (Maybe I have 1-50 HTTP posts when an alert triggers to format all the different types of messages, and 1-50 HTTP corresponding posts when the alert resets, etc...) THEN disable that alert forever. The alert then holds a "library" of all my alert actions. Then I have to create additional alerts and then when actually setting up the alert conditions and associate them to the alert actions in the "library".
Thanks! I'd love to know if I'm just overlooking something obvious!
