Skip to main content
Panther Knowledge Base

Do alerts that don't meet thresholds fire eventually?

QUESTION

If there is a rule with a threshold 10 events, but only 2 events trigger for this alert, does the alert never fire? Or does it fire eventually with just 2 events?

ANSWER

 No.  The alert would never fire.  If your threshold is set to 10, that means it will only trigger after the 10th failed login.  However, you can easily tune the threshold number for a rule up or down if desired.