synoti logosynoti logo
Threat Management Alert Management

Alert Management

UTM Stack relies on over a thousand correlation rules refreshed each day. It also uses threat intelligence correlation rules that refresh every hour. This section explains how to manage the alerts these correlation rules generate.

Introduction

Alert Management is not merely a component; it is the foundation of every effective security information and event management (SIEM) system. Its purpose is to monitor varied data sources actively, identify anomalies, detect suspicious behavior, and then generate alerts according to pre-configured correlation rules. The ultimate aim? To give organizations actionable insights and keep their digital perimeter secure.

A modern correlation engine drives our Alert Management system. This engine continuously processes incoming data in real time, compares it with a set of defined correlation rules, and generates an alert with matching severity based on the possible risk level.

Note:This module serves as the central hub for every detected alert, presenting relevant details and enabling efficient alert handling. It is more than a tool; it is your position from which to reduce risks before they escalate.

1. Data Grid

The Data Grid forms the core of our Alert Management system and provides an interactive view of every detected alert. It gathers and displays key details:

  • Rule Name: The particular conditions from which the alert arose.

  • Severity: The urgency level tied to the alert.

  • StatusA live status indicator: new, under review, or resolved.

  • SensorThe data source or trigger point that identified the possible danger.

Note:* The Data Grid, apart from its intuitive design, allows alerts to be catalogued based on any field, defaulting to a chronological hierarchy.*

Key Alert Operations

💡*** Tip:**** Dive deeper with these pivotal operations:*

Converting an Alert to an Incident

Not every alert is the same. Some require closer attention. Use the Create Incident feature to either open a new incident from an alert or attach it to an existing incident. When an alert becomes an incident, an automatic email is sent to notify stakeholders listed in the Unified Security Stack settings.

Tagging Alerts: Beyond the False Positive

False positives arrive alongside alerts. Our system lets you create Tag Rules directly from alert fields, using the False Positive tag by default. After a rule tags an alert as a false positive, similar alerts will no longer flood your dashboard.

Distilling Alerts through Filters

Use filters to focus your alert view. A single selection lets you reshape the alert landscape according to the attributes you choose.

Annotating Alerts

Collaboration matters in every cybersecurity effort. Annotating alerts lets teams share observations, questions, or extra context about the nature and possible impact of an alert. These annotations serve as shared markers, helping team members work from the same understanding of potential threats.

2. Filter

In a fast-changing digital landscape, the number of alerts can become overwhelming. The Filters section gives users greater control over which alerts they view. With robust and customizable filtering tools, teams can concentrate on the alerts that are truly important.

Whether you are focusing on High Severity alerts from one data source or locating alerts produced by a specific rule, the Filter section provides an unmatched level of precision.

In addition to the default filters, the Alert Management Module is flexible enough for customization. This means your filtering approach can change as the needs of your organization change.

Using the Filters section effectively not only makes alert management easier but also strengthens the reactive and proactive security posture of your organization.

3. Further Alert Management Capabilities

Our Alert Management Module includes many features built to help you stay ahead of possible threats. In the top right of the module interface, you will find three main functions: Save Report, Manage Tags, and View Tag Rules.

Save Report

In certain situations, offline analysis and record-keeping are essential. The Save Report feature lets users extract and download a full report of alerts in standard CSV format. Whether you need a detailed review of data from the past week or a wider view of alert trends, this feature supports flexible data export for any analysis or compliance requirement.

Manage Tags

Tagging is not only about applying labels; it also supports classification, prioritization, and rapid identification. The Manage Tags feature lets users define their own tag taxonomy, so alerts can be categorized and handled quickly.

View Tag Rules

The View Tag Rules section combines automation with classification. Here you can create, review, and manage rules that automatically tag incoming alerts according to pre-set conditions. This auto-tagging streamlines alert handling and adds predictability to how alerts are categorized.

Tip: By adopting the full set of features in our Alert Management Module, organizations can prepare themselves to identify, classify, and respond to potential threats quickly. In an environment where response time is critical, we make sure you have the tools to stay ahead.