Create an Anti-Flooding Policy for Alerts

Applies To: WatchGuard Advanced Reporting Tool and Data Control This topic applies to the WatchGuard endpoint security modules, Advanced Reporting Tool and Data Control. These optional modules are available with WatchGuard EPDR and WatchGuard EDR.

Anti-flooding policies limit the number of alerts in the event that the alert triggers frequently over a short period of time.

When you create an anti-flooding policy, you specify:

• Maximum number of alerts to receive
• Time period to which the previous criteria applies
• A reminder if the alert repeats after the established time period

To create an anti-flooding policy for alerts, from the Advanced Visualization Tool:

1. From the left pane, select Administration > Alerts Configuration.
2. Select Alert Policies.
3. Select Anti-Flooding Policy.
4. Click New Anti-Flooding Policy.
   The Anti-Flooding Policy dialog box opens.

5. In the Policy Name text box, type a unique name that identifies the policy.
6. In the Send a Maximum Of text box, type the maximum number of alerts to send.
   If more alerts are triggered, they will not be sent. However, the Alerts Dashboard always keeps a record of every time the alert triggers. You can also query the complete history of triggered alerts in the siem.logtrust.alert.info data table.
7. In the Over a Period Of text box, type the period of time to limit alert distribution for.
8. From the drop-down list, select a time unit (minutes, hours, days).
9. Click Save.

Edit and Delete Anti-Flooding Policies

You can edit or delete an existing anti-flooding policy on the Antiflooding Policy tab.

To edit an anti-flooding policy, in the Advanced Visualization Tool:

1. From the left pane, select Administration > Alerts Configuration.
2. Select Alert Policies.
3. Select Anti-Flooding Policy.
4. From the list of policies, click in the row for the policy you want to edit.

5. Select Edit.

6. In the Send a Maximum Of text box, change the number of alerts allowed.
7. In the Over a Period Of text box, edit the time period, as required.
8. Click Update.

To delete an anti-flooding policy, in the Advanced Visualization Tool:

1. From the left pane, select Administration > Alerts Configuration.
2. Select Alert Policies.
3. Select Antiflooding Policy.
4. From the list of policies, click in the row for the policy you want to delete.

5. Select Delete.
   A Warning dialog box opens.

6. Click Yes.

Related Topics

About Real-Time Alerts in the Advanced Visualization Tool

Create Alerts in the Advanced Visualization Tool