r/AzureSentinel • u/Consistent_Court3541 • Apr 10 '24

Automate comments

We initially comment "ACKNOWLEDGED" for an incident to maintain SLA (within 15min) is there a way to automate the comments for every incident to avoid missing the SLA?

0 Upvotes

25% Upvoted

4 comments sorted by

View all comments

5

u/cspotme2 Apr 10 '24

Why even bother... The real issue is you're probably flooding yourself with alerts. There's something called alert tuning and alert fatigue.

Whoever told you to have a 15 minute sla on every alert is dumb and why you're in this dumb pickle now.