Analyzing a Respond trigger

Once you have configured the Respond module with a rule or rules, Respond will alert you when these rules are triggered. Refer to Investigat ing alerts using Analysis.

  1. Select customer(s)/partner, date range, and/or account(s).
  2. Type Respond into the Filter Event Type(s) field.
  3. Click SaaS Alerts Respond - Rule Triggered.
  4. Click Run Report.

After running the report, go to View Rule Trigger by clicking on the link icon to find information such as details of alert(s) that triggered the Respond rule, response action, and rules trigger history.

You will find next to Triggered Because the alerts that subsequently triggered this rule based on the configured conditions. By selecting the info icon, you will see more detailed information on these conditions.

The taken Response Action appears below the Triggered Because details. 

Clicking the magnifying glass icon will display more information about an individual alert.

The History section displays the date and time when the Respond rule action took place.

If the rule has been set to Manual Approval, you will have the following options available:

  • Approve: Approving the rule triggers and Respond actions will be taken upon after your approval. A SaaS Alerts Respond Notice Acknowledged alert will be generated.
  • Manually remediated: Should be used when the MSP admin/user already took the remediated action outside of SaaS Alerts. No actions will be performed by Respond; however, the rule will be marked as remediation completed and a SaaS Alerts Respond - Rule Manually Remediated alert will be generated.
  • Reject: The MSP admin of the rule opted out of having Respond take any actions on the specific rule. A SaaS Alerts Respond Notice Rejected alert will be generated. 

If the remediation failed, you will have the option to reject, manually remediate, or approve the rule trigger. Respond will remind the rule administrator every 15 minutes after the remediation failed. After the third reminder, the rule is set to be automatically ignored if no action is taken.