Alerts serve as the initial indicators of potential security incidents. They are generated by third-party security systems or through custom detection workflows. By providing early warning signals, alerts play a crucial role in case management, helping teams identify, investigate, and respond to threats swiftly and effectively.

To learn more about Alerts and their role in Case Management, please refer to our detailed guide available here.

​
Creating a New Alert

Please note that you can assign multiple alerts to a single case or a single alert to many cases.
1

Open the Case and Add a New Record

To attach an Alert to a Case, first double-click on the desired Case. In the overview section of the selected Case, go to the “Alerts” tab. Then, click the “New Record” button in the top-right corner.

2

Open the New Record Form

3

Fill in all the necessary fields

ParameterDescription
NameThe name assigned to the alert.
EventThe event associated with the alert.
SeverityThe severity rank of your Case. It can be: Low, Medium, High or Critical
VendorThe Vendor associated with the alert.
Alert TypeThe alert category type.
DescriptionA brief explanation explaining the alert.
ProcessedA checkbox to mark the alert as processed; check to mark as processed, uncheck to mark as unprocessed.
Template ExistsIndicates whether the alert has been ingested into the system.
Linked CasesThe Name and ID of the Case(s) you want to link to this current alert.
Linked ObservablesThe Name and ID of the Observable(s) you want to link to this current alert.
Linked AttachmentsThe Name and ID of the Attachment(s) you want to link to this current alert.
Linked TasksThe Name and ID of the Task(s) you want to link to this current alert.
4

Save the Alert

Once completed, select the Add Record button in the bottom-right corner.

​
Editing an Alert

NOTE

Please note that you can Edit Alert(s) directly within the alerts tab of a case overview. Simply double-click on the table row to make any necessary changes. Once you have completed your edits, click anywhere on the screen to save the changes.

1

Select an Alert to Edit

Select the Alert you would like to edit and click on it.

2

The'Edit Record' Form will appear

3

Update Alert Details

Make any necessary changes you would like to the Alert fields and then click Save in the bottom-right corner.

4

View Updated Alert

The newly made changes will reflect in the selected Alerts

​
Deleting an Alert

1

Choose Alert to Delete

Navigate to the Alert you want to delete and select the three dots icon .

2

Delete Alert

The delete option will appear. Click Delete, and the selected Alert will be removed from your existing Alerts.

Alerts serve as the initial indicators of potential security incidents. They are generated by third-party security systems or through custom detection workflows. By providing early warning signals, alerts play a crucial role in case management, helping teams identify, investigate, and respond to threats swiftly and effectively.

To learn more about Alerts and their role in Case Management, please refer to our detailed guide available here.

​
Creating a New Alert

Please note that you can assign multiple alerts to a single case or a single alert to many cases.
1

Open the Case and Add a New Record

To attach an Alert to a Case, first double-click on the desired Case. In the overview section of the selected Case, go to the “Alerts” tab. Then, click the “New Record” button in the top-right corner.

2

Open the New Record Form

3

Fill in all the necessary fields

ParameterDescription
NameThe name assigned to the alert.
EventThe event associated with the alert.
SeverityThe severity rank of your Case. It can be: Low, Medium, High or Critical
VendorThe Vendor associated with the alert.
Alert TypeThe alert category type.
DescriptionA brief explanation explaining the alert.
ProcessedA checkbox to mark the alert as processed; check to mark as processed, uncheck to mark as unprocessed.
Template ExistsIndicates whether the alert has been ingested into the system.
Linked CasesThe Name and ID of the Case(s) you want to link to this current alert.
Linked ObservablesThe Name and ID of the Observable(s) you want to link to this current alert.
Linked AttachmentsThe Name and ID of the Attachment(s) you want to link to this current alert.
Linked TasksThe Name and ID of the Task(s) you want to link to this current alert.
4

Save the Alert

Once completed, select the Add Record button in the bottom-right corner.

​
Editing an Alert

NOTE

Please note that you can Edit Alert(s) directly within the alerts tab of a case overview. Simply double-click on the table row to make any necessary changes. Once you have completed your edits, click anywhere on the screen to save the changes.

1

Select an Alert to Edit

Select the Alert you would like to edit and click on it.

2

The'Edit Record' Form will appear

3

Update Alert Details

Make any necessary changes you would like to the Alert fields and then click Save in the bottom-right corner.

4

View Updated Alert

The newly made changes will reflect in the selected Alerts

​
Deleting an Alert

1

Choose Alert to Delete

Navigate to the Alert you want to delete and select the three dots icon .

2

Delete Alert

The delete option will appear. Click Delete, and the selected Alert will be removed from your existing Alerts.