hi all, Regarding alert setting, I would like to know if it can be set as below.
There are alerts related to “down” and alerts related to “up” in graylog.
In the “down” related alert setting in graylog, is there a way to prevent the “down” related alert from being executed if the “up” related alert occurs within 5 seconds after the “down” related alert occurs?
Unfortunately there is no way to accomplish this in Graylog Open. The Correlation Engine feature required to do this requires either Graylog Operations of Graylog Security.
You can try our plugin: GitHub - airbus-cyber/graylog-plugin-correlation-count: Alert condition plugin for Graylog to perform correlation
The use case you describe can be accomplished thanks to it.
