Custom actionable alerts based on multiple inspectors
under review
M
Matthew Lavoie
I would like the ability to use custom metrics that are based on different inspectors within one alert. I have a custom metric based on the Office 365 inspector, and another custom metric based on the Active Directory inspector. I would like to create a single actionable alert that is based on both of these custom metrics. I should be able to customize what triggers the alert with simple logic. (metric 1 and metric 2) or (metric 1 or metric 2) etc. The benefit of this would be that I can create even more reliable alerts that help prevent my team from acting on false tickets. Currently if I use the stale user metric for Active Directory, we can receive false tickets due to the user only using Office 365 and not recently logging into their corporate network. Have the alert check both of these sources of data prior to creating or updating the alert would provide a single ticket to look into stale users instead of 2 separate tickets that may or may not be valid.
E
Erik Zwep
Is this the same request?
https://liongard.canny.io/feature-requests/p/allow-conditions-from-multiple-inspectors
Merged in a post:
Include Metrics from Multiple System Types in the Customized Actionable Alert Builder
A
Addison Caldwell
Example: Stale User AccountsA lot of our clients have a sync set between AD & M365. So, if someone hasn't logged into 365 directly, but has been active in AD, then they show up in a stale user accounts alert for M365 in Roar - we don't want to disable them in 365, because that would disable them in AD, as well. Therefore, we would like the Alert to tell us if a user has been stale in both of those systems for 30 days.
S
Shayla Johnson
Matt, this is the exact idea for the exact use case that I was putting together tonight!I am surprised there aren't more votes for this!!!