Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

How to notify only red incidents.

Hello.

There is a way to notify only the red incidents by mail?

Thanks.

Andrea.

2 REPLIES
Silver

Re: How to notify only red incidents.

Here is how you set a filter so only red incidents will show in your query:

In the Query/Reports page, you will see a shaded 'Query Type' area where you can define the criteria for your query. There are several columns here. The 4th column is called 'Events' and should have the word 'Any' under it. Click the word 'Any' in the 'Events' column to change it.

In the page that follows, you will see a field labeled 'Restrict to Severity'. Change this to 'RED' and hit 'Apply'. You can define what specific red events to show on this page, or you can change other query criteria to further filter your results.

New Member

Re: How to notify only red incidents.

Unfortunately that doesnt work. That will alert you on a Red event, not Red Incidents.

Unfortunately, this is an absolutely MASSIVE flaw in Cisco MARS. There are some hacks relating to duplication of rules but they can cause more problems of their own.

You will need to bug Cisco for this functionality I think.

145
Views
4
Helpful
2
Replies
CreatePlease to create content