Skip to content

Commit aa4efb9

Browse files
stuart-jaeckel-netwrixstuart-jaeckel-netwrix
authored
Merge pull request #41 from netwrix/stuart/undo-ai-restruc
Reverting topics back to before AI restructuring
2 parents b64352c + 3d53538 commit aa4efb9

File tree

26,469 files changed

+601276
-572282
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

26,469 files changed

+601276
-572282
lines changed

‎docs/1secure/admin/alerts/index.md‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
---
2+
id: alerts
3+
title: "Alerts"
4+
pagination_label: "Alerts"
5+
sidebar_label: "Alerts"
6+
sidebar_position: 79
7+
description: "Learn how to configure and manage alerts that notify you of critical security events and actions in your organization."
8+
---
9+
10+
# Alerts
11+
12+
When you create an alert profile, several alerts are preconfigured for it. You can, however, choose
13+
to enable or disable them as well as add custom alerts to the profile. These alerts are triggered by
14+
specific events. This means that when the defined action (event) is detected within the organization
15+
the alert profile is assigned to, an alert is generated. Alerts notify you of critical actions that
16+
impact your organization's security, enabling you to respond swiftly to potential risks.
17+
18+
You can access the generated alerts in the following ways:
19+
20+
- View the alerts generated for an organization on the Netwrix 1Secure dashboard. See the
21+
[1Secure Dashboard](/docs/1secure/admin/dashboard/index.md) topic for additional information.
22+
- Receive alerts as email notifications sent to the specified email address(es). See the
23+
[Manage Delivery Settings for an Alert Profile](profiles.md#manage-delivery-settings-for-an-alert-profile) topic
24+
for setting up email notifications.
25+
26+
Follow the steps to view the alerts within an alert profile.
27+
28+
**Step 1 –** Navigate to Configuration > Alerts.
29+
30+
**Step 2 –** Click an alert profile. The alerts for the profile are displayed in a list.
31+
32+
![Alerts List within an alert profile](/img/product_docs/1secure/admin/alerts/alertslist.webp)
33+
34+
You can view the following for each alert in the list:
35+
36+
- Source – Indicates the origin or type of data that triggers the alert. For example, Activity
37+
Records.
38+
- Alert Name – The name of the alert
39+
- Is Active – Indicates whether the alert is activated. You can toggle it ON or OFF as required.
40+
- Grouping On – Indicates whether grouping is applied to the alert. If yes, then it displays the
41+
criteria, such as What, Who, Where, etc.
42+
- Threshold – The threshold value set for the alert. The threshold is the minimum number of activity
43+
records that must occur within a specified time frame (threshold period) to trigger an alert.
44+
- Threshold Period – The threshold period set for the alert. The threshold period is the maximum
45+
duration, starting from the first activity record, within which the specified number of activity
46+
records (threshold) must occur to trigger an alert.
47+
- Batching Period – The batching period set for the alert. The batching period feature allows you to
48+
receive a single notification that includes all alerts triggered during the specified period.
49+
50+
## Add a Custom Alert
51+
52+
Follow the steps to add a custom alert.
53+
54+
**Step 1 –** Navigate to Configuration > Alerts.
55+
56+
**Step 2 –** Click an alert profile. The alerts for the profile are displayed in a list.
57+
58+
**Step 3 –** Click **Add**. The New Alert pane is displayed.
59+
60+
![New Alert Pane](/img/product_docs/1secure/admin/alerts/addcustomalert.webp)
61+
62+
**Step 4 –** Select a custom report from the Report drop-down menu to trigger the alert when a new
63+
record is generated for the report. See the [ Custom Reports](/docs/1secure/admin/searchandreports/customreports.md)
64+
topic for additional information.
65+
66+
**Step 5 –** Specify a name and description for the alert.
67+
68+
**Step 6 –** Toggle the **Is Active** switch to ON to activate the alert. Notifications are sent for
69+
active alerts only.
70+
71+
**Step 7 –** Toggle the **Is Grouped** switch to ON, which displays the Grouped On drop-down menu.
72+
When grouping is enabled, alerts are organized based on the criteria you select in the _Grouped On_
73+
drop-down menu.
74+
75+
**Step 8 –** Select one of the following options from the **Grouped On** drop-down menu:
76+
77+
- Who – Groups alerts with respect to the user who performed the activity (deleted an account,
78+
created a record, etc.)
79+
- Where – Groups alerts with respect to the location where the activity is performed. For example,
80+
SharePoint Online site, file server, etc.
81+
- What – Groups alerts with respect to the object the activity is performed on, such as a computer,
82+
file, etc.
83+
84+
Example: You have two users, User 1 and User 2, each performing different actions. By setting
85+
"Grouped On" to "Who", alerts will be generated per user, resulting in two separate alerts — one for
86+
User 1 and another for User 2. Each alert will include only the activity associated with that
87+
specific user. If grouping is not enabled, all activities will be consolidated into a single alert
88+
based on the specified _threshold_ and _threshold period_.
89+
90+
**Step 9 –** In the Threshold field, specify a threshold for the alert. The threshold is the minimum
91+
number of activity records that must occur within a specified time frame (threshold period) to
92+
trigger an alert. For example, if the threshold is set to 3, an alert will be triggered when at
93+
least 3 activity records are generated within the specified time frame.
94+
95+
**Step 10 –** In the Threshold Period field, specify a threshold period for the alert. The threshold
96+
period is the maximum duration, starting from the first activity record, within which the specified
97+
number of activity records (threshold) must occur to trigger an alert. For example, if the threshold
98+
is set to 5 and the threshold period is 10 minutes, at least 5 activity records must be generated
99+
within 10 minutes to trigger an alert.
100+
101+
**Step 11 –** If you do not want alert notifications to be sent to you each time an alert is
102+
generated, there is a batching period option. In the Batching Period field, specify a batching
103+
period for the alert. The batching period feature allows you to receive a single notification that
104+
includes all alerts triggered during the specified period. For example, if the batching period is
105+
set to 30 minutes (00:30:00) for an alert such as "Computer removed," you will receive a single
106+
notification for the alerts generated during that time frame, rather than receiving individual
107+
notifications for each alert.
108+
109+
**Step 12 –** Click **Save**.
110+
111+
The alert is configured and added to the list.
112+
113+
## Modify an Alert
114+
115+
Follow the steps to modify a preconfigured or custom alert.
116+
117+
**Step 1 –** Navigate to Configuration > Alerts.
118+
119+
**Step 2 –** Click an alert profile. The alerts for the profile are displayed in a list.
120+
121+
**Step 3 –** Click the **Edit** icon for an alert. The Edit alert pane is displayed.
122+
123+
**Step 4 –** Modify the required information. See the
124+
[Add a Custom Alert](#add-a-custom-alert) topic, starting from Step 4 for additional information.
125+
126+
**Step 5 –** Click **Save**.
127+
128+
## Delete a Custom Alert
129+
130+
Follow the steps to delete a custom alert.
131+
132+
**Step 1 –** Navigate to Configuration > Alerts.
133+
134+
**Step 2 –** Click an alert profile. The alerts for the profile are displayed in a list.
135+
136+
**Step 3 –** Click the **Delete** icon for an alert to delete it. A dialog box is displayed,
137+
prompting you to confirm the deletion of the alert.
138+
139+
**Step 4 –** Click **Yes**. The alert is deleted from the system.

‎docs/1secure/admin/alerts/profiles.md‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
id: alert-profiles
3+
title: "Alert Profiles"
4+
pagination_label: "Alert Profiles"
5+
sidebar_label: "Alert Profiles"
6+
sidebar_position: 80
7+
description: "Learn how to create and manage alert profiles with grouped configurations and delivery notification settings."
8+
---
9+
10+
# Alert Profiles
11+
12+
Alert profiles provide a way to easily group alert configurations and delivery notification settings
13+
together. You can create an alert profile, enable relevant alerts for the profile, and assign it to
14+
organization(s). Additionally, you can customize delivery settings and specify which user(s) will
15+
receive notifications when alerts in the profile are triggered.
16+
17+
To view the alert profiles, navigate to Configuration > Alerts.
18+
19+
![Alert Profiles List](/img/product_docs/1secure/admin/alerts/alertsprofiles.webp)
20+
21+
Alert profiles are displayed in the list with the following information:
22+
23+
- Alert profile – The name of the alert profile
24+
- Alerts enabled – The number of alerts enabled for the profile
25+
- Used in organizations – The number of organizations the alert profile is applied to
26+
- Notification delivery – Indicates whether email notifications are configured for the profile
27+
28+
**NOTE:** The alert profile named _Netwrix Profile (Default)_ is available by default and is
29+
automatically applied to all managed organizations.
30+
31+
## Add an Alert Profile
32+
33+
Follow the steps to add an alert profile.
34+
35+
**Step 1 –** Navigate to Configuration > Alerts.
36+
37+
**Step 2 –** Click **Add profile**. The New alert profile pane is displayed.
38+
39+
![New Alert Profile pane](/img/product_docs/1secure/admin/alerts/addalertprofile.webp)
40+
41+
**Step 3 –** Enter a name for the alert profile in the Name field and click **Save**.
42+
43+
The alert profile is added to the list. You can:
44+
45+
- Assign this profile to an organization. You can do this when creating a new organization or
46+
editing an organization. See the [Add Organizations](/docs/1secure/admin/organizations/addorganizations.md) topic
47+
for additional information.
48+
- Click the profile to review the list of alerts, enable the desired alerts, make necessary edits
49+
for alerts, and set delivery settings for the alert profile. See [Alerts](/docs/1secure/admin/alerts/index.md) topic for
50+
additional information.
51+
52+
## Modify the Name of an Alert Profile
53+
54+
Follow the steps to modify the name of an alert profile.
55+
56+
**Step 1 –** Navigate to Configuration > Alerts.
57+
58+
**Step 2 –** Click the Edit icon for an alert profile. The Edit alert profile pane is displayed.
59+
60+
**Step 3 –** Modify the name of the profile.
61+
62+
**Step 4 –** Click **Save**.
63+
64+
## Delete an Alert Profile
65+
66+
**NOTE:** (1) The alert profile named _Netwrix Profile (Default)_ cannot be deleted.
67+
(2) When an alert profile is deleted, the _Netwrix Profile (Default)_ is automatically assigned to
68+
the organizations that were previously assigned the deleted profile.
69+
70+
Follow the steps to delete an alert profile.
71+
72+
**Step 1 –** Navigate to Configuration > Alerts.
73+
74+
**Step 2 –** Click the Delete icon for an alert profile to delete it. A dialog box is displayed,
75+
prompting you to confirm the deletion of the profile.
76+
77+
**Step 3 –** Click **Yes**. The alert profile is deleted from the system.
78+
79+
## Manage Delivery Settings for an Alert Profile
80+
81+
You can receive alerts by email or through the third-party ticket service, as used by the Managed
82+
Service Providers.
83+
84+
Follow the steps to configure alerts by email.
85+
86+
**Step 1 –** . Navigate to Configuration > Alerts.
87+
88+
**Step 2 –** Click an alert profile. The alerts for the profile are displayed in a list.
89+
90+
**Step 3 –** Click the Email icon under Delivery Settings. The Email Delivery Settings pane is
91+
displayed.
92+
93+
![Email Delivery Settings pane](/img/product_docs/1secure/admin/alerts/alertsemaildelivery.webp)
94+
95+
**Step 4 –** . Toggle the Enabled switch to ON to enable email notifications for the alert profile.
96+
97+
**Step 5 –** In the Email Addresses field, enter the email address of a recipient for alert
98+
notifications and click the Add icon. To specify multiple email addresses, add them one by one.
99+
100+
**Step 6 –** Check the **Email Organization Admins** check box to send the alerts to all the
101+
organization admins by email.
102+
103+
**Step 7 –** Click Save.
104+
105+
You may also link to a third-party ticketing system. See the
106+
[Third-party systems](/docs/1secure/integrations/index.md) topic for additional information.

‎docs/1secure/admin/alerts/timeline.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
---
2+
id: alerts-timeline
3+
title: "Alerts Timeline"
4+
pagination_label: "Alerts Timeline"
5+
sidebar_label: "Alerts Timeline"
6+
sidebar_position: 81
7+
description: "Learn how to view and analyze triggered alerts using statistics, charts, and comprehensive alert lists."
8+
---
9+
10+
# Alerts Timeline
11+
12+
The Alerts Timeline page provides a view of triggered alerts. It highlights key statistics,
13+
including the top 5 alert types by count and a timeline chart to visualize alerts triggered over
14+
time. The page also displays a complete list of generated alerts for thorough analysis and
15+
monitoring.
16+
17+
To access the Alerts Timeline page, click **Home** at the top and do one of the following:
18+
19+
- On the Top 5 Organizations with Most Alerts chart, click a bar. It opens the Alerts Timeline page
20+
that displays alert-related data for the organization represented by the selected bar.
21+
- On the Top 5 Triggered Alerts by Type chart, click a bar. It opens the Alerts Timeline page that
22+
displays alert-related data for all managed organizations.
23+
- In the organizations list, click an organization name to navigate to the Organization Statistics
24+
page, then click the Alerts Timeline chart. It opens the Alerts Timeline page that displays
25+
alert-related data for the organization selected in the organizations list.
26+
27+
![Alerts Timeline Page](/img/product_docs/1secure/admin/dashboard/alertstimeline.webp)
28+
29+
If you are a managed organization user, this page displays insights specific to your organization.
30+
31+
If you are a managing organization (MSP) user, this page provides insights for all your
32+
organizations.
33+
34+
Top 5 Alerts by Count
35+
36+
This card displays a pie chart illustrating the five most frequently triggered alert types. Each
37+
slice represents the share of an alert type relative to the others. Hover over a slice to view the
38+
exact number of alerts for that type.
39+
The legend maps the colors used in the pie chart to the names of the alert types along with the
40+
share percentage.
41+
42+
Click an alert type on the legend to disable it. Disabled alert types are not displayed in the pie
43+
chart. Hence, the pie chart displays only the enabled alert types and their percentage shares with
44+
respect to each other. You can click a disabled alert type on the legend to enable it.
45+
46+
Alerts Timeline
47+
48+
This card displays a bar chart illustrating the number of alerts triggered for the period selected
49+
in the timeframe drop-down menu. Hover over a bar on the chart to view the exact number of alerts
50+
triggered on any specific date.
51+
52+
Alerts List
53+
54+
This section lists all the triggered alerts with the following information:
55+
56+
- Organization – Displays the name of the organization the alert belongs to. Click an organization
57+
name to view its alert-related data on the Alerts Timeline page. On filtering data by
58+
organization, the Organization column is hidden from the Alerts list.
59+
- Alert time – Displays the date and time when the alert is triggered
60+
- Source type – Displays the origin or type of data that triggers the alert. Source types are:
61+
62+
- Activity Records – Alerts generated based on user activities or actions
63+
- Health Notifications – Alerts related to system performance, for example, when Netwrix 1Secure
64+
is unable to communicate with Netwrix Cloud Agent.
65+
66+
- Alert name – Displays the name of the alert
67+
- Num activity records – Displays the number of activity records associated with the triggered
68+
alert, based on the threshold value set for it. The threshold is the minimum number of activity
69+
records that must occur within a specified time frame (threshold period) to trigger an alert.
70+
- Last updated – Displays the date and time when the alert is triggered, based on the threshold
71+
value set for it. The threshold is the minimum number of activity records that must occur within a
72+
specified time frame (threshold period) to trigger an alert.last updated.
73+
- Item – Displays the name of the entity by which the alert is grouped, such as a computer, file,
74+
user, etc.
75+
- Activity Records – Click the Activity Records link for an alert to navigate to the Activity page,
76+
where you can view a detailed report for that alert type. See the
77+
[Activity Reports](/docs/1secure/admin/searchandreports/activity.md) topic for additional information.
78+
79+
Click a column header to sort data in the alerts list by that column in ascending order. An arrow
80+
appears next to the column name to indicate the sort order. Click the column header again to sort
81+
the data in descending order.
82+
83+
Edit Alerts Settings
84+
85+
Click the **Edit Alerts Settings** link to navigate to the Alerts page, where you can create a new
86+
alert and modify existing ones. See the [Alerts](/docs/1secure/admin/alerts/index.md) topic for additional
87+
information.
88+
89+
## Filter Data
90+
91+
Multiple filters are available on this page to enable you to filter data as desired. You can apply
92+
one or more filters at a time.
93+
94+
- Organizations – Select an organization from the Organizations drop-down menu to view its
95+
alert-related data.
96+
- Filter by Keyword – Type a search string (only alpha characters allowed) in the Filter by keyword
97+
field and press Enter. The Alerts list displays the data that matches the specified keyword.
98+
- Alert – Select an alert type from the Alert drop-down menu. The charts and the alerts list display
99+
data specific to the selected alert type. By default, All is selected.
100+
- Item – Select an item from the Item drop-down menu. The charts and the alerts list display alert
101+
data specific to the selected item. By default, All is selected.
102+
- Timeframe – Select a time period from the Timeframe drop-down menu. The charts and the listing on
103+
the page display data for the selected time period. For example, if you select 7 Days, the data
104+
will reflect information for the past 7 days. By default, 30 Days is selected. Options are:
105+
106+
- 7 Days
107+
- 30 Days
108+
- 90 Days

0 commit comments

Comments
 (0)