Aggregated Alert Enhancements: Advanced Reporting & Whitelisting
Advanced Reporting and whitelisting have been extended to support aggregated alerts (alerts triggered when multiple rules in a rule group fire together, as distinct from individual alerts triggered by a single rule).
Advanced Reporting now includes an aggregate scope field on the alerts table, plus two new tables — alert_rules and alert_rule_transaction_links — so the contributing rules and transactions behind an aggregated alert can be reported on individually or joined back to the alert.
The aggregated alert detail UI now shows rule-level and transaction-level whitelist indicators. When every transaction across every rule in the group is covered by an active whitelist entry, the alert automatically transitions to Whitelisted status.
User Guide Reference: Transaction Monitoring -> Advanced Reporting Tables
User Guide Reference: Transaction Monitoring -> Entity Whitelisting