Edit and clone triggered alerts' definition
What permissions do I need?
Apart from the Triggered alerts (view) permission needed to access the Alerts overview area, you also need the Alert configuration (Manage) permissions to interact with alert definitions (see a detailed description of the alerts permissions here).
Additionally, you need to have alerts assigned with Manage access (see Assign resources to a role), which will be those you will see on the list.
Editing and cloning definitions
From the alert list
You can modify the alert definition of a triggered alert to change some its settings, or clone it if you want yo keep the original. Simply click the ellipsis menu at the end of the row and select Edit definition or Clone definition.
A new window opens with the settings of the alert definition. The fields you can modify and the implications depend on the action being performed (click here if you are editing or here if you are cloning).
When editing, you can open a search with the alert query to observe the impact of your modifications on the data as you edit. You can also do this in a new browser tab, which allows for editing of the query while keeping the triggered alerts page open.
From the alert details window
You can also edit and clone alert alert definitions from the details window, which is accesible by clicking an alert’s ID on the list (more info about the details window here). Click ellipsis button at the top right and select Edit/Clone definition.
Similar to when it's executed from the alert list, a new window opens with the settings of the alert definition. The fields you can modify and the implications depend on the action being performed (click here if you are editing or here if you are cloning).
Similar to when it's executed from the alert list, the edit dialog gives you the option to open a search with the alert query to observe the impact of your modifications on the data as you edit. You can also do this in a new browser tab, which allows for editing of the query while keeping the triggered alerts page open.
Â