There are cases where many more alerts will be deleted or moved than is intended. For instance, if from the main page you select Unique Alerts then click on Total Alerts for a signature, then up in the Summary Statistics box you select Sensors the base_stat_sensor.php page will show you the sensors that have that Signature. If you now, down in the Action menu, select one or more rows to delete or move alerts with this Signature from one or more sensors, it will delete EVERY alert from those sensors. The Signature id is not passed to the SQL query that deletes the alerts, only the SID.
This is true in 1.4.5 and I believe the last few versions have the same problem.
Log in to post a comment.