| Description | Optional, if present, specifies that this is a
summary alert, representing one or more alerts with
common characteristics. The numeric value indicates
the number of times the signature fired since the
last summary alert with a matching 'initialAlert'
attribute value. The first and all subsequent
summary alerts in a sequence will use the eventId
of a previous non-summary evAlert in the initialAlert
attribute value. All alerts represented by the
summary alert share the same signature and
sub-signature id. The summaryType attribute defines
the common characteristic(s) of all alerts in the
summary. The 'final' attribute indicates whether
this is the last evAlert containing the same value
in the 'initialAlert' attribute. The 'final'
attribute may be omitted if and only if its value
is false. |