Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  3. IT Analytics Help
  5. Section IV. End user
  7. Alert configuration
  9. Add/Edit an Alert Policy
  11. Name the Policy and Define Time Intervals

Name the Policy and Define Time Intervals

To start creating the Alert Policy, assign a name, define the frequency of the symptom you are monitoring, and modify the schedule if required.

Table: Name the Policy and define Time Intervals

Field

Description

Alert Policy Name

Enter a name for the Alert Policy. This a required field.

Active

Click toggle button to activate the policy. To avoid un-necessary notifications, deactivate Alert Policies when there are situations such as planned outages or scheduled maintenance. You can also suppress alerts from the Alert Details report.

See the Report Reference Guide for details in this report.

Symptom Frequency

It refers to the frequency at which the alert is generated. The options are explained below:

  • Every time: This is the default setting and indicates that the alert will be generated every time alert conditions are met for the selected scope.

  • Consecutive X: This symptom frequency implies that the alert will be generated if the alert condition is met for X times. For Example: In Job Finalized rule policy, the scope has condition for exit status 99 and symptom frequency as 2, then an alert is generated if there are 2 or more than 2 consecutive failed jobs with the error code 99.

    Host         Job Exit Status   Outcome
Client A     99                -
Client A     0                 -
Client A     99                -
Client A     99                Alert Generated
Client B     99                -
Client B     0                 -
Client A     99                Alert Generated
Client A     156               -
Client A     99                -

  • X out of Y: It implies that the an alert will be generated if there are at least X total alerts in last Y attempts. Maximum value for Y can be 10.

    For example if symptom frequency is 3 out of 5, then the following is true:

    • Always last Y attempts are analyzed. In this example, last 5 attempts will be looked back.

    • No alert is generated until 5 attempts are complete (since the value of Y is 5). Hence, even if 4 failures are observed, an alert is not raised until the fifth one is processed.

    • After 5 (Y) attempts, a look back calculates if there are at least 3 (X)or more failures out of the 5 attempts.

      For example, the table below explains the alert generation for Symptom Frequency: 3 out of 5 and Scope: Client A with Exit Status 99.

      Host         Job Exit Outcome 
             Status   
Client A     0        -
Client A     99       -
Client A     0        -
Client A     99       -
Client A     99       Alert Generated
Client A     0        Alert Generated
Client B     0        -
Client B     99       -
Client A     156      Alert NOT Generated as out
                      of last 5 attempts 3 have
                      failed with Exit Status 99.
Client A     99       Alert Generated

Schedule

Some Rules are based on a schedule. If the selected Rule is based on a pre-defined schedule, that default schedule is displayed. Click the icon to overwrite the default.

See Scheduled Rules vs. Run Time Rules.

Warning Alert

Select the pre-defined Alert to issue for a warning condition. This would be triggered when the threshold value for a Warning condition is reached.

See Adding an Alert Notification Delivery Method.

Critical Alert

Select the pre-defined Alert to issue for a critical condition. This would be triggered when the threshold value for a Critical condition is reached.

See Adding an Alert Notification Delivery Method.

Check Existing Alert

When enabled, an alert is generated only if there is no existing alert found for the alert policy and alert object combination.

Number of Failures

The minimum count of failures that must occur in the previous 'n' minutes (where 'n' is the value specified in Number of Minutes field) before an alert is triggered.

Note:

For more details, refer to the example given at the end of this table.

Number of Minutes

The rolling time window within which the 'Number of failures' threshold must be met in order for an alert to be generated.

Note:

For more details, refer to the example given at the end of this table.

Look Back Hours

Configurable only if Check Existing Alerts is enabled and indicates the number of hours after which another alert can be generated provided the alert-triggering event has not resolved. The default number of hours are inherited from the system parameter Existing alert default look back (hours) that is defined under Admin > Advanced > System Configuration > Portal > General

Include NetBackup policy for existing alert check

Configurable only if Check Existing Alerts is enabled and applicable only for alerts integrated with ServiceNow, such as ServiceNow: Job Finalized.

Checks for the uniqueness of client and NetBackup policy. If the NetBackup policy is not found (such as for Restore jobs), then the existing alerts / tickets are checked by including Job Type instead of NetBackup Policy

Enable NetBackup Backup Window Lookup

Select this parameter to process NetBackup specific ServiceNow job failure. Selecting this option, a ticket is raised in ServiceNow when there is no successful backup for a client after the close of its Backup Window associated with client's backup policy and schedule.

If, at the time of Backup Window processing is over, there is a running job found, then a ticket is created if the job finishes as failure irrespective of the exit status of the jobs finished with in the Backup Window.

Note:

Selecting NetBackup Backup Window Lookup option, the Symptom Frequency option is disabled and do not have impact on the alerts or ServiceNow tickets processing. The Symptom Frequency and Enable NetBackup Backup Window lookup options are mutually exclusive.

Add Alert Notification

Click to setup the alert notification method as you are adding the Alert Policy. This can also be add outside of adding an alert policy.

See Adding an Alert Notification Delivery Method.

Description

Add an optional description for the Alert Policy.

Category Grouping

Choose how the alerts must be grouped for matching events of primary and media servers:

  • Both (Default): Separate alert for each media server and primary server.

  • Primary Server Only: Single alert for each primary server, regardless of how many media servers match.

  • Media Server Only: Single alert for each media server, without grouping by the primary server.

Note:

The following is an example of an alert rule which will be triggered with the values specified in Number of Failures and Number of Minutes fields.

The alert rule is triggered when the count of actual failed jobs is more than or equal to 'X' and no alert is triggered previously, within the last 'Y' minutes.

Given the value of 'X' for Number of Failures and 'Y' for Number of Minutes fields

Table: Define Time Intervals

Number of Failures 'X'

Number of Minutes 'Y'

Actual Number of failures

Category Grouping ticket

Category Grouping ticket generated?

10

30

5

No

No (Number of actual failures is less than 10)

10

30

15

No

Yes (Number of actual failures is more than 10 and open ticket NOT found for the server.)

10

30

11

Yes

No (Number of actual failures is more than 10 and open ticket found for the server)

Feedback

Was this page helpful?
Previous

Select an Alert Rule

Next

Define the Scope to Monitor

Feedback

Was this page helpful?