Alert Management
Viewing, filtering, and acknowledging security alerts.
Overview
Alerts are generated by agents when a guard detects a security violation. They stream to the central server in real-time (or queued offline).
Alert Severities
| Severity | When Used |
|---|---|
| CRITICAL | USB insertion blocked, process killed, tamper detected |
| HIGH | File upload blocked, large clipboard copy |
| MEDIUM | Screenshot attempt, unauthorized print |
| LOW | File watcher detection, process running (alert mode) |
| INFO | Whitelisted USB connected, encryption status change |
Filtering Alerts
Filter alerts by:
- Severity — CRITICAL, HIGH, MEDIUM, LOW, INFO
- Guard — Which guard generated the alert
- Device — Alerts from a specific device
- Acknowledged — Show only unacknowledged alerts
- Date range — Filter by creation date
Acknowledging Alerts
- Single alert — Click the acknowledge button on an individual alert
- Bulk acknowledge — Select multiple alerts and use bulk acknowledge
Only acknowledged alerts are removed from the active alert count on the dashboard.
Alert Details
Each alert includes:
- Guard name — Which guard triggered the alert
- Severity — CRITICAL through INFO
- Details — JSONB payload with guard-specific information (e.g., USB serial number, blocked domain, killed process name)
- Device — Which endpoint generated the alert
- Timestamp — When the violation occurred
Alert Volume
Agents can send up to 200 alerts per API call in batch mode. For high-volume environments, consider:
- Setting guards to block mode (fewer repeated alerts)
- Using alert-level filtering to focus on CRITICAL/HIGH
- Implementing alert archival for long-term storage