realert_key as value from match

[sopmtech]

Hi!

I want to silence the rule based on its match body. According to the documentation enhancements always run after silence logic is applied so I cannot modify realert_key with custom enhancement. query_key is not always suited for realert_key.

Is there any workaround for this?

[jertel]

I'm unaware of a way to accomplish this without submitting a PR. There is a run_enhancements_first parameter you can try but I believe that will still run the enhancement too late for what you're trying to accomplish.