From the list of alerts grouped by victim IP address (the Hosts view of the Alerts tab), you can view alert acknowledgment history, including acknowledgment comments. You can also edit acknowledgment comments.
Prerequisites
You are logged in to the Web UI as Admin, Analyst, or Monitor.
Click the Alerts tab.
Click the Hosts link in the control bar.
Select the Show Acknowledged check box in the Filter sidebar and then click the Apply button.
The list shows alert groupings—grouped by victim IP address—that contain acknowledged events. For each alert grouping listed, the victim IP address is displayed in green in the Hosts column.
To search the list for entries for a particular victim IP address, do the following:
Enter the victim IP address in the search text box for Host IP/Mask.
Click the Apply key.
The list shows only the alert groupings for the specified victim IP address.
To details about a particular alert grouping, click the Host IP in the first column. The entry expands to show Host Details.
To view alert acknowledgment details for the victim IP address, click the Acknowledgment history for <victim IP Address> link.
The Notes column contains the comment that was entered when the alert was acknowledged.
The acknowledgment history reports the following information about each acknowledgment or clearing of the acknowledgment for the alert grouping:
Field
Description
Notes
Comments entered by the administrative user who acknowledged or cleared the acknowledgment of the alert grouping.
Edits
Links for the operation you can perform on the alert comment:
• Edit Note
• Cancel Edit
Events
Number of individual events acknowledged or cleared.
Acknowledged at
Time and date of the acknowledgment
By
Admin username
(Optional) To edit the comment, do the following:
Click the Edit Note link in the Edits column. The Edit Note for this Acknowledgment dialog displays.
Drag the lower right corner of the Notes text box to expand the text area.
Edit the text in the Notes text box.
Click Update.