Hi,
I have set an alert when the security port is turned on, but I don’t know what rule to set to make the alert disappear. Turning on port security reads from the snmp trap: %Port security violation at interface%
Thanks for reading 
You need to use the macro for the last X date time and compare to the date time column in the event log table otherwise it will never clear the alert (in essence it will auto clear after that period of time).