Difference in Alerts count

[Shubham_Manjhi]

Hi All,

I Came up with a weird issue where i checked for data for past 1 hour and found the Alerts are mismatching across different windows.
Like in SIEM Search can see only 13, under ALERTS AND IOCs - 300+ and when did retro-hunt its also different.
Does anyone have idea why it might happen?

[Eoved]

Hi,
Alert discrepancies in SecOps can stem from time range mismatches, RBAC restrictions, filter settings, data ingestion delays, search logic, differing rule logic, or variations in retro-hunt data.

I suggest using the direct way to view alerts in SecOps:
Go to Detection > Alerts and IOCs — this page lists all current alerts.
*Make sure the selected time range matches your expectations, and remove any active filters to see all alerts.

[Rene_Figueroa]

Doing retrohunts is likely to change the alerts count as well since new data (raw logs/UDM events) might be available for the rule to create detections. it is also possible, that the data changed due to enrichment and hence more detections are created. A new rule version may also create additional alerts.