Property reference

sn_em_tbac.tag_excluded_alert_fields

The sn_em_tbac.tag_excluded_alert_fields property specifies which alert field names should be excluded from the options when creating a new Alert Clustering Tag. Admins should review this property to ensure that only relevant fields are available for selection, enhancing the clarity and effectiveness of alert management.

Default
Not set
Type
string
Application
Tag Based Alert Clustering Engine

Key questions about this property

The answers below summarize the purpose, scope, default effect, and review scenarios for this property.

What does it do? This property defines a list of alert fields that are excluded from the selection options during the creation of Alert Clustering Tags, impacting how alerts are grouped.
What area does it affect? Alert Clustering Configuration
What does the default mean? No default value is documented in this property record.
When should you review it? Review this property when configuring alert clustering to refine the fields available for tagging.

Out of the box property record

Raw metadata from the property record.

Property name sn_em_tbac.tag_excluded_alert_fields
Sys ID 2982c05ab72a70107c038229ce11a9c1
Type string
Application Tag Based Alert Clustering Engine
Default value Not set
Description A comma separated list of alert (em_alert) field names (not labels) to exclude from the fields list options that show when creating a new Alert Clustering Tag that its source is set to "Alert field", e.g. "type,event_class".
Updated 2023-12-04 01:53:53

Sources

Official references and nearby text excerpts where this property appears.

Documentation excerpt View supporting context
Context preview Snippet 1
... are case sensitive by default. To disable case sensitivity, set the sa_analytics.correlation_case_sensitive parameter to false. • You can also configure alert fields to be excluded from the search, using the sn_em_tbac.tag_excluded_alert_fields property. By default, the following are excluded by this property: ◦type ◦event_class Override group description Default group descriptions begin with a “Group of alerts” prefix, followed by the description of ...

More in Other namespaces

Other properties in the same namespace.

All 204 properties in Other namespaces →