Disable Re-Alerting

[Bongani Buthelezi]

Hi Team,

Is there a way to disable re-alerting of the same events from the same log file?
I have noticed when new log entries are added to my file. Wazuh seems to re-alert on all the initial events/logs it has already alerted on earlier.

I have added two screenshots to show the initial alerting and the alerting after two new log entries were added to the file.

Kind regards,

Bongani

[Ian Yenien Serrano]

Hi, sorry for the delay, but I had replied to you and for some reason the message got deleted,

I understand that you have custom rules and you want to see 1 time on the dashboard, all logs that match the rules you have will be added to the dashboard, what you can do is add the "ignore" setting to the rule so that once a rule is executed it waits that long to be taken into account again.

https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html#rule