Jump to content

Oneview/Nebula Notification triggers


Recommended Posts

With regard to the "Detections" triggers.  I'm concerned there is a decision branch missing.

If I choose the "Action Taken" condition, the only operator is "is equal to" and the choices are "Blocked, Found, Quarantined, Deleted form quarantine and Restored from quarantine".

If I select more than one choice, for example "Found" and then "Quarantined", I am apparently working with an AND, not an OR.  So for the notification to fire, a detection must be BOTH "Found" and "Quarantined".   Further, If I choose to add another condition, then that 2nd condition is also an AND, as it clearly says "All of these conditions must be met".

So, let's say that I want to get notified BOTH when something is found & quarantined, AND when something is found and NOT quarantined (arguably a more important event).  The only way to do this is to have TWO separate notifications, one where you choose "Found & quarantined", and a second one where you choose only "Found".   At least I think, anyway.   The problem with this solution is that when a detection is found and quarantined, it will fire BOTH notifications.   But if I remove the second notification so I don't get duplicate notifications in this scenario, then I don't get a notification if a detection is "Found" but not "Quarantined" for some reason - which as I stated above, is probably a more important thing to get notified about.

Maybe the answer is to delete the FIRST notification and only have one that fires when something is found (regardless of whether or not it is quarantined).  I don't want to miss any important events, but I don't want to get spammed with notifications, either.  I'm trying to setup notifications to auto-create tickets, so finding the right balance is important.

Am I missing something here?  It seems like we need an OR choice for the trigger values, which of course, we don't have currently.

Question 1:  Does this make sense?

Question 2:  What notifications have YOU setup for your clients?


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.