I would like to provide a saved search for my team which shows all alerts which are either currently open, or were closed within the last 24 hours. Is this possible?
We have all our alerts set to automatically close when they're resolved, so if a low severity alert fires transiently, it's possible it could disappear before anyone notices it. I want to have a view where it is easy to see which alerts have fired recently, without requiring my team to look at the whole list of historical alerts looking at the datetimes to see if they're recent etc. It would just be much simpler to have this view which shows them the exact items they should be concerned with.
I noticed that there is a "lastOccurredAt" field mentioned in the docs, which sounds like close to what I'd want...I couldn't figure out how to dynamically filter to "the last 24 hours" with it...
Any insight is appreciated, thanks!