Module alert_context 

Triage context for one alert: the alert, the rule that fired it, the rule’s exception lists, the cases that contain the alert, and the rule’s alert volume in a window.

Structs

AlertContext

RelatedCase

One case that contains the alert. detail is the case read by id.

RelatedCases

The cases route answer: total rows, of which the first five are read.

Enums

AlertFinding

Static findings, in the order a report lists them.

Functions

alert_context

Read the alert, then its rule, the rule’s exception coverage, the cases that contain the alert, and the rule’s alert activity, one request at a time. The alert read is primary; every later read is a part.