Skip to main content
Alerts is the queue of detection-rule firings. Model-flagged findings live on Anomalies. Two tabs: Queue and Rules. Rules requires the manage alerts permission.

Tab: Queue

Findings a custom rule matched — severity, rule name, actor, host, and time. Open a row for evidence, then continue in Logs.

Tab: Rules

Subtitle: Custom if-this-then-alert rules over live telemetry. New Rule and Create with AI open the builder (/alerts/rules/new). Rules can evaluate per event or as a time aggregate (count / sum / average over a window) with conditions on process, file, network, and identity fields. When a rule matches it raises a finding into this queue.
Last modified on October 8, 2026