I do have a set of rules (Automatic responses) for processing new RSD detections. Some of them add Rogues to Exceptions (based on Organization name, like all Cisco stuff, or Polycom) another response does Agent Query, and finally there is one to send me an e-mail with alert and rogue system details.
The problem is that I cant set order how they're processed, so all of them run at the same time. This way I get e-mail alert about all detections, despite they are added to exceptions by another Response.
Is there any way to set Response processing order, or dependency? Or to delay the Response?
perhaps you could cram all related actions into one response and not keep one just for email action. I would check if some or all of the response's filter are true for all of them, thus causing them to trigger one after the other.
What do you think?