I'm looking for information on internal tie-breaking logic when multiple event policies match the same event and have the same weight. From what I have read, this logic is typically based on policy ID or creation order - but which way ? oldest wins OR newest wins ?
My team have a set up meant to handle VMware events (API) differently based on the Organization. However they are doing this using device groups in the suppression tab which isn't effective if the event match is the same.
