Viewing Alerts
  • 19 May 2024
  • 3 Minutes to read
  • Dark
    Light
  • PDF

Viewing Alerts

  • Dark
    Light
  • PDF

Article summary

On the top of any screen in the system, the number of Unseen alerts is displayed near the bell. AlertsBell

To view all Alerts triggered in the system

  • In the left navigation panel, click the Findings icon FindingsIcon
    OR
  • On the top right corner of any screen in the system, click the Alerts bell.
    FindingsALertsPageNew

Alerts Table

The Alerts table presents alerts triggered in the system sorted by date, from the newest to the oldest.
When a triggered alert meets the Mute condition configured in a Findings rule, the alert is muted, meaning there is no notification of the alert.

  • By default, Hide muted alerts is toggled on, meaning that unmuted alerts only are displayed.
  • Toggle off Hide muted alerts to display both unmuted and muted alerts.

The Alerts table provides the following information:

FieldDescription
StatusThe status of the alert. Available statuses: Unseen, Open, In Progress, Closed, Canceled
Note: When you open an Unseen alert from the Alerts table or from Rules Manager> Rule drawer> Alerts History table, the alert status changes to Open.
Alert IDID number of the alert. Table is sortable by Alert ID.
Note: Each time an alert is triggered in the system, it is assigned an ID number in sequential order.
Rule NameThe name of the rule that triggered the alert.
SeverityThe alert severity. The severity of a Findings alert is equivalent to the severity of the rule that triggered it. The severity of alerts from other sources is fixed per source and is not user configurable. Available options are: Informational, Low, Medium, High, Critical
MessageThe system message that notified about the alert. Hover over the tooltip to display a detailed description of the alert.
Date and TimeThe timestamp in UTC time that the alert was triggered.
Check and NotifyThe frequency that the rule checks the entity. Relevant for Findings Center alerts only. N/A for Enforcement Center alerts.
SourceThe source of the alert (for example, Findings Center, Enforcement Center). Learn more about the various alert sources.
Mute StatusMuted or Unmuted. When Hide muted alerts above the table is toggled on (the default), only unmuted alerts are displayed.

Searching and Filtering

You can filter the alerts that are displayed. You can then use the filters to create queries based on the filters and also save them as queries which can be used later on. Read more about queries based on filters.

FilterAlerts

The following filters are available:

  • Search Findings - Text appearing in Alert IDs or Rule Names.
  • Severity - The severity of alerts.
  • Finding Rule Name - The name of Finding Rules that triggered the alerts.
  • Source - The source of the alerts.
  • Status - The status of the alerts.
  • From - To - The date range for which to display alerts. See Filtering by Date below to learn how to choose the date range.
  • Hide muted alerts - A toggle that hides or displays muted alerts.
Note:
  • The filters show only those options that appear in the Alerts table.
  • For each filter with a selection, you can select one or more options.
  • If you want to filter by many options, you can click Select All to select all options, and then click those options that you want to clear.

Filtering by Date

You can filter alerts for a specific date and time range.

To filter by date and time range

  1. Click From - To. The calendar pages for the previous and current months open. The current date is selected by default in the To calendar page.

DateRangePicker

  1. In the From and To calendar pages, click the start and end dates of the date range, respectively.

    • Use the arrows in the calendar header to open calendar pages of other months or years.
    • To filter results for a specific date, select the same date in both calendar pages.
  2. If you want to start or end at specific times in the date range, click Select Time, and in the Time picker that opens, select the time to start on the From date and the time to end on the To date.

  3. Click OK to set the filter.

Alerts Retention

The Alerts page always displays the latest 100,000 alerts.

Performing Actions on Alerts

Marking Alerts as Seen

Mark a single or bulk selection of Unseen alerts as seen using the Mark as seen action.


For general information about working with tables refer to Working with Tables.



Was this article helpful?

Changing your password will log you out immediately. Use the new password to log back in.
First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.