Hi everyone, new to Vision One and the forum. I'm helping my team set up some audit procedures, and we need to document all the alerts we've suppressed.
I've looked around the console, but I'm finding it tricky to get a simple, complete list. The activity logs show actions, but I'm hoping for something more straightforward for reporting.
Could anyone share how you pull a clear list of suppressed alerts? Maybe a specific query or report you run? I want to make sure we're not missing anything during our reviews. Thanks in advance for any tips! 😊
I'm new to this too! I had the same issue last week. The activity logs were too noisy for me as well.
What worked for me was going to the "Alerts" section and using the filter for "Status." Filter by "Suppressed." That gave me a list I could export to CSV for our audit. But I'm not 100% sure it catches *all* historical ones - just the currently active suppressions.
Does anyone know if that filtered view shows ones that were suppressed and then maybe later unsuppressed? I'd want to track those changes too for a complete audit trail.