We've got a bunch of alarm enrichment rules that run through pre-processing in the NAS.
I'm wondering how they work:
Does an alert iterate through the rules and if it matches a rule break out of the iteration?
Iterate through the rules and if it matches a rule continue through the loop and if it hits another one it will enact those rules as well?
Hope that makes sense - let me know if I need to provide more