Monthly Alert Count by Severity

What this query does

Aggregate alert counts by severity level for monthly trending reports

SWQL Query

SELECT Severity,
       COUNT(*) AS TotalAlerts,
       SUM(CASE WHEN Acknowledged = 1 THEN 1 ELSE 0 END) AS Acknowledged,
       SUM(CASE WHEN Acknowledged = 0 THEN 1 ELSE 0 END) AS Unacknowledged
FROM Orion.AlertActive
GROUP BY Severity
ORDER BY Severity DESC

alerts

aggregation

monthly

reporting

severity

Source:POLARISNOC· POLARISNOC Original

Unlock the full POLARISNOC hub

AI-powered SWQL generation, script management, CVE tracking, and verified solution intelligence.