Skip to content

Commit 5dce484

Browse files
author
yelevin
committed
Added text from info bubbles
1 parent 256d0f6 commit 5dce484

File tree

1 file changed

+6
-3
lines changed

1 file changed

+6
-3
lines changed

articles/sentinel/automate-incident-handling-with-automation-rules.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -119,9 +119,12 @@ An incident property's value was
119119

120120
#### Items vs. collections
121121

122-
For incident properties that are collections of items, such as tags—an incident can have multiple tags applied to it—you can define conditions that check **each item in the collection separately**, and conditions that check **the entire collection as a unit**.
122+
For incident properties that are collections of items, such as tags—an incident can have multiple tags applied to it—you can define conditions that check **each item in the collection individually**, and conditions that check **the entire collection as a unit**.
123123

124-
This distinction matters when your condition is a negative (does not equal, does not contain, and so on), and some items in the collection fulfill the condition and others don't.
124+
- **Any individual item** operators check the condition against every item in the collection. The evaluation is *true* when *at least one item* satisfies the condition.
125+
- **Collection of all items** operators check the condition against the collection of items as a single unit. The evaluation is *true* only if *the collection as a whole* satisfies the condition.
126+
127+
This distinction matters when your condition is a negative (does not equal, does not contain, and so on), and some items in the collection satisfy the condition and others don't.
125128

126129
Let's look at an example where your condition is, **Tag does not contain "2024"**, and you have two incidents, each with two tags:
127130

@@ -132,7 +135,7 @@ Let's look at an example where your condition is, **Tag does not contain "2024"*
132135

133136
In this example, in *Incident 1*:
134137
- If the condition checks each tag individually, then since there's at least one tag that *fulfills the condition* (that *doesn't* contain "2024"), the overall condition is **true**.
135-
- If the condition checks the entire collection as a unit, then since there's at least one tag that *doesn't fulfill the condition* (that *does* contain "2024"), the overall condition is **false**.
138+
- If the condition checks all the tags in the incident as a single unit, then since there's at least one tag that *doesn't fulfill the condition* (that *does* contain "2024"), the overall condition is **false**.
136139

137140
In *Incident 2*, the outcome will be the same, regardless of which type of condition is defined.
138141

0 commit comments

Comments
 (0)