cisagov / crossfeed

External monitoring for organization assets
https://docs.crossfeed.cyber.dhs.gov
Creative Commons Zero v1.0 Universal
366 stars 54 forks source link

Update Alarms to Use Statistic: Sum (vs. SampleCount) #2389

Closed Matthew-Grayson closed 10 months ago

Matthew-Grayson commented 10 months ago

🐛 Summary

SampleCount is causing alarms to emit a false positive. SampleCount counts the number of data points collected. This number is always the same regardless of the metric filter specified. Sum counts the number of instances that a metric filter is triggered, which is what we want.