Key questions about this property
The answers below summarize the purpose, scope, default effect, and review scenarios for this property.
| What does it do? |
This property defines a list of alert fields that are excluded from the selection options during the creation of Alert Clustering Tags, impacting how alerts are grouped. |
| What area does it affect? |
Alert Clustering Configuration |
| What does the default mean? |
No default value is documented in this property record. |
| When should you review it? |
Review this property when configuring alert clustering to refine the fields available for tagging. |
Out of the box property record
Raw metadata from the property record.
| Property name |
sn_em_tbac.tag_excluded_alert_fields |
| Sys ID |
2982c05ab72a70107c038229ce11a9c1 |
| Type |
string |
| Application |
Tag Based Alert Clustering Engine |
| Default value |
Not set |
| Description |
A comma separated list of alert (em_alert) field names (not labels) to exclude from the fields list options that show when creating a new Alert Clustering Tag that its source is set to "Alert field", e.g. "type,event_class". |
| Updated |
2023-12-04 01:53:53 |
Sources
Official references and nearby text excerpts where this property appears.
Context preview
Snippet 1
... are case sensitive by default. To disable case sensitivity, set the sa_analytics.correlation_case_sensitive parameter to false. • You can also configure alert fields to be excluded from the search, using the sn_em_tbac.tag_excluded_alert_fields property. By default, the following are excluded by this property: ◦type ◦event_class Override group description Default group descriptions begin with a “Group of alerts” prefix, followed by the description of ...
Related properties
More in Other namespaces
Other properties in the same namespace.
All 204 properties in Other namespaces →