'Get-mcasalert -resolutionstatus open' Not working

[tlrbradley]

Dismissed alerts seem to show up properly, but when searching for open alerts, I am getting both open and resolved alerts. Since the limit is 100, I am actually only seeing 7 open alerts in my search and the rest are resolved. Any thoughts?

[StevenShockley]

I'm seeing the same thing. Using -Skip 100 seems to be workaround, but not a solution since I don't know if there's a way to find out how many alerts there are total (to create a loop).

It'd be nice if the script did its own throttle management, too. I don't really want to write an application just to do get-mcasalert | set-mcasalert -dismiss.

[TristankMS]

Same problem here. I worked around it by adding a new "Open" switch to get-mcasalerts.ps1 and then used that in place of the more complex filter instead, and it seems to work reliably.

[dpdrc]

Same problem here. I worked around it by adding a new "Open" switch to get-mcasalerts.ps1 and then used that in place of the more complex filter instead, and it seems to work reliably.

Hi

Would you be able to share the code for this please?

[TristankMS]

Hi

Would you be able to share the code for this please?

My original was from 3.3.4; I forked the current version and added the same lines. YMMV! https://github.com/TristankMS/MCAS/blob/master/Functions/Get-MCASAlert.ps1