To mark one or multiple alerts as processed:
This opens the table of alerts.
You can select all alerts by selecting the check box in the table header.
This opens the action confirmation window.
You can also leave a comment that will be displayed in the alert change history.
The selected alerts will be marked as processed. If the alerts were assigned to other users, they will be marked as processed by you.
You can view all processed alerts by filtering alerts based on the status of their processing by the user.
If an alert based on TAA (IOA), IDS, or URL that is equivalent to a processed alert is received within a 24-hour period (from 00:00 to 23:59), the program will either create a new alert or update the information about an identical alert with the New or In process status.
Users with the Security auditor role cannot assign and process alerts.
Page top