Security alerts

An admin connects your security monitoring tool (for example Wazuh) under Monitoring & security › Security overview › Security sources. Its alerts then appear under Monitoring & security:

• Security overview: the current picture across your assets and accounts.
• All security alerts: every alert, with the original evidence from the security tool.
• Grouped security alerts: alerts grouped by rule into one group per situation, for example repeated failed sign-ins followed by a successful one on the same server.

Groups, not every alert

Alerts on the same asset, account or source within a short time are grouped, with a severity from the most serious alert inside and a plain explanation of why they were grouped. A group is a lead to investigate, not a confirmed compromise.

AI investigation

Start an AI investigation on a group to get a summary of what happened, how likely it is to be harmful and recommended actions. Each recommendation must be accepted or rejected by a person; nothing is changed on your systems by the investigation itself.

Closing a group

Set a group to monitor, resolved or dismissed. Resolving or dismissing needs a reason (for example “benign vulnerability scanner”), which is kept for audit. Link a group to a case when it needs work: type the case reference, for example INC-000112 or just 112. Approving the recommendation Escalate to a tracked Incident creates the incident and links it for you.