Hi Austin,   My Answers in red I assume you are talking about workspaces that were created during alert generation. Is that right? Yes, after an alert generation, the workspace includes only the alert icon itself, and the icon of the actionable entity. The actionable entity can be expanded as there is a some relationship between different entities. I just want them to be expanded. If so, are the workspaces created according to the setting in the strategy or do the incoming alerting events include json that specifies exactly which entities should be in the workspace? the workspace created according to the strategy, as there is no json included. When you say the network diagram should be expanded, are you saying that the nodes that were placed in the workspace during the alert generation are not initially visible? Or are you saying that the nodes that were added to the workspace are visible, but you would like the diagram to automatically expand out one level beyond what was originally added to the workspace. (Could you attach a screenshot of what you are seeing?) No nodes were placed manually, I just want the diagram will expand as I'd open the alert / workspace tab. below a screenshot from Alert.   All I need is that the "9" indicator will be expand.      Thanks, Idan   ... View more

Hi @susantrueman , In order to route investigations to different departments there is the necessity to know which scenarios raised the highest score. Right now, the score in workflows refers to ALERT itself and not the scenario-fired event score.   for more information, I have opened a thread: https://communities.sas.com/t5/SAS-Viya/RESTful-API-URL-for-alerting-event/td-p/888094  Eventually, I've been asked to open a suggestion here.   Thanks, Idan     ... View more

Hi @joeFurbee , Did you get a chance to check it for us? 🙏   Thank you ... View more

Hi @joeFurbee , Did you had a chance to check with the development team?   This is very crucial for us to be able to see the scenario(s) (or the greatest scenario by score) of an Alert, to be able to route the Investigation between the departments.   Thanks, Idan     ... View more

My request above is probably a bit confusing, but a simple question is how do I get "scenario_fired_event" data while I have an Alert_id through a REST Service? I've tried  /svi-datahub/documents/alerts/{alert_id}/  while I should refer to another directory... Could anyone advise?   Thank you! ... View more

Hi @susantrueman , I'm familiar with the documentation you sent, but it refers only to three fields (as far as I understood): actionable_entity_nm actionable_entity_type_nm actionable_entity_id So if I want to refer to curr_score_val field (which is the "Score" field I'm looking for),  there is no reference on how can I define something like this. there is no documentation with examples even...   What can you advise? To reach SAS support team with a ticket to help me configure this? It's sound like something that should be very easy but yet...   Thanks, Idan ... View more

Hi @_austin_ , Thanks for the response. Let's say there is an activity that has been routed to the correct queue, and after an investigator review this alert, he decides to suppress the activity for 1 month. when he does that, the alert score is decreasing to 0 and is routed to the suppression queue. (Until here, it's working fine) After a month, the alert is getting back to its initial score, which is ok, but we need it to return to the initial queue.   my configuration is: 1. In the domain, there is an option for Suppressed event queue configured to a new queue called "HR_Close_S_q". 2. When the scenario fired-events are generated they are routed to a queue: "HR_Close_q" with a priority of 26. 3. when a user suppressed a fire event, the alert score is updated to 0 and the alert itself is routed to the "HR_Close_S_q" queue (which has a priority of 29) 4. after sometime configuration, the fire event is restored, and the score of the event returns to the initial score, but the alert is not routed back to the relevant queue ("HR_Close_q")     ... View more