File Anomaly Alert not updating with new error codes

@Stefan Vollrath , we do include new error codes in new releases, so that’s likely what’s happening here.  

Can you clarify on where you are not seeing them added to your alerts?

I can move this to its own thread once we have more info 😎

@Mike Struening Default Alert “File Activity Anomaly Alert” doesn’t include all the Codes relevant to the used Release (FR24 in this case). Get the Events but no Alerts acting on them out of the box.

Thanks, @Stefan Vollrath !  Let me ask around internally.  Can you confirm your exact release (11.24.xx)?

Also, @Ken_H can you confirm he same for comparison (if you get a chance)?

My File Activity Anomaly Alert seems to include several error codes not shown on the screen capture from @Stefan Vollrath.  

@Ken_H , what version is your CS on?  I suspect the alert updates, but within various versions, not on its own.

I’m running 11.26.8.

We are running 11.24.38 and 11.20.90 at the moment

11.26.8 came out Feb 1

11.24.38 came out in March

11.20.90 came out Feb 1

I was thinking there was a time release difference at play here, but there’s not.

@Stefan Vollrath , I am going to check with someone internally, though it might be best to get a support case opened to see what happened.

@DMCVault 

I have more detail.

From the Security Dashboard:

● The alert is triggered by event code 7:211|7:212 given as regular expression.
● Use regular expression as 7:211|7:212|7:293 in feature release later than 22
● Use regular expression as 7:211|7:212|7:293|7:269 in feature release later than 25
● Use regular expression as 7:211|7:212|7:293|7:269|14:323|69:52 in feature release later than 26
●The alert should not have any criteria other than Error Code selected

Can you confirm the alert criteria you are using compared to your Feature Release.

That’s the problem, the list described here and used by the alert doesn’t match what the software uses otherwise.

We are running FR24, regularly get Event Code 7:269, but that isn’t covered by the alert before FR25.

Mediating that and adding the newer codes to the alert then result in a critical alert from Security Assessment Report as the rule now no longer matches what is checked there…

Having an all green Security Assessment or have all Anomalies alerted shouldn't be a trade-off we have to make.

@Stefan Vollrath , something isn’t right, then.

Open a support case and share the number here so I can track it!

@Mike Struening Stefan’s case is 220412-138.

Thanks, @Jacek Piechucki !!!

Small update, looks like they are backporting the alert to MR24.

Will keep following the case on my end.

Looks like form ID 4947 is the fix via WinX64_11.0.0B80-SP24_SP24-HotFix-5751 which requires 11.24.43.

Let us know once it is installed and working 🤓