I have set up some Numerical Outlier detections in the MLTK, on our ES Search Head.
They are set up as alerts in Splunk on our Enterprise Security Search Head.
The Numerical Outlier alert looks back over a 2 hour time range. Which creates 24 data points (120 mins / 5 min increments = 24 event data points)
The problem is - in Enterprise Security (since this is a notable event), we receive 24 separate notable events! We correctly only receive 1 email each time the alert fires, but 24 notable events in ES.
I have the alert set to trigger "Once", rather than "Per Result"
Is there anything else I can do to make sure ES doesn't get slammed with 24 notables every time this alert fires?
