I have some events that I would like to stop appearing as incidents in my Mars appliance. Consequently, I've set up a rule to tune the specific event. It is listed in my Drop Rules and is set as active. However, the event type continues to appear in my Incident report. Any ideas of why this may be occurring?
Would you mind sharing the specific event and the drop rule you made? Somtimes that 'particular' event gets tuned (and displays a 'S' icon next to it) but it gets displayed with 'other events' that are part of the 'same incident'. You have to tune those other non-dropped events on that particular incident
to completely get rid of that incident.