Monitoring alerts

The Alerts page displays a list of all unresolved violation alerts in the system. At the top of the page are 3 charts that help identify the level of alert activity in the system:

1. Violations — number of unresolved and resolved violations in the past month.
2. Unresolved violations — by risk level
3. Time to resolve violations (Past month)

On the main Alerts page is a list of unresolved alerts. You can access the list of resolved alerts and notifications from the left menu pane. If you do not see the left menu pane, swipe to the left browser edge to show the menu.

• Monitoring alerts
• Filter alerts
• Sort alert details
• Export alerts list
• Display alert summaries
• Display command in detail
• Resolve an alert
• Resolve multiple alerts

Filter alerts

On the Alerts page, you can filter the listed alerts by doing any of the following:

• Use the search bar to locate a specific alert or trigger.
• From the left menu pane, click one of the available options to filter the list by server group or trigger group.
  • Server groups are configured on the Company settings page. For more information, see Company settings
  • Trigger groups are configured on the Triggers page. For more information, see Trigger groups.

Sort alert details

On the Alerts page, you can sort the listed alerts doing any of the following:

• Click on the far right to show or hide headings that are relevant to you.
  • Select Toggle density to change the amount of spacing in each row.
• Click a heading to sort the list by that heading.
• Click and drag a heading to move the column left or right.

Export alerts list

On the Alerts page, you can export the list of displayed alerts.

1. Click on the top-right corner of the table to export a copy of the listed items in .CSV or JSON format.
   1. In the following dialog, select the preferred export format from the drop down list.
   2. Enter the number of rows that you want to export.
   3. Select the headings that you want to include in the export.
   4. Click Export.
   5. In the following dialog, right-click the bar and save the linked target file as instructed.
   6. When the file finishes downloading, click OK to close the dialog.

Display alert summaries

On the Alerts page, hover over the alert command or link text in the table to see a summary of the server, session, user status, or number of violations associated with that alert.

• In the summary display, click any of the linked text to see more details.
• Click Run in Sources to see the command in context on the Sources page.
• Click Run in Insights to create a new report about the summarized item.

Display command in detail

On the Alerts page, click a row to expand and show the alert command in the terminal display.

• >_ command triggered a violation.
• Click [link] to see the command output or child commands.

Resolve an alert

On the Alerts page, you can resolve any alert in the Unresolved list.

1. At the right-end of the alert row, click Resolve.
   1. In the following dialog, enter any required notes related to the alert.
   2. If there are other violations associated with the alert, you can click to enable them all be resolved at the same time.
   3. Click Resolve.

Resolve multiple alerts

On the Alerts page, you can choose to resolve some or all alerts in the Unresolved list simultaneously.

1. At the left-end of the alert rows, select the check box beside all the alerts you want to resolve. Or, check the box in the heading row to select all alerts.

   

   1. At the top of the list, click Resolve selected.
   2. In the following dialog, enter any notes related to the alert or investigation that may be required.
   3. Click Resolve.