Alert Management

Alerts are the primary interface for security operations in Tamandua Sentinel. This guide covers alert viewing, filtering, investigation workflows, and alert management best practices.

Accessing Alerts

Navigate to Alerts in the left navigation panel to access the alert management interface.

[Screenshot: Alerts page with list view, filters, and action toolbar]

Alert List and Filtering

Alert List View

The alert list displays security alerts with the following default columns:

Customizing Columns

Add or remove columns:

1. Click the Columns button in the toolbar
2. Select desired columns
3. Drag to reorder
4. Click Apply

[Screenshot: Column customization panel with available fields]

Additional available columns:

• Detection Source (YARA, Sigma, ML, Behavioral)
• Process Name
• Process Path
• User
• IP Address
• File Hash
• Rule Name
• Resolution
• Time to Acknowledge
• Time to Resolve

Filtering Alerts

Quick Filters

Use the filter bar for rapid filtering:

[Screenshot: Quick filter bar with severity and status filters applied]

Advanced Filters

Click Advanced for complex queries:

severity = "critical" AND
status = "open" AND
created > "2024-01-14" AND
(category = "malware" OR category = "ransomware") AND
agent.group = "Production Servers"

Saved Filters

Save frequently used filters:

1. Configure desired filters
2. Click Save Filter
3. Enter a name
4. Optionally set as default view
5. Access saved filters from the dropdown

Filter Presets

Built-in presets for common views:

Sorting

Click column headers to sort:

• First click: Ascending
• Second click: Descending
• Third click: Clear sort

Default sort: Severity (descending), then Created (newest first)

Search

Full-text search across:

• Alert title
• Process name and path
• File name and path
• Command line
• Hash values
• IP addresses
• Hostnames

Alert Details View

Click any alert to open the detail panel.

[Screenshot: Alert detail panel showing all sections expanded]

Alert Header

Key information at a glance:

+----------------------------------------------------------+
| [CRITICAL]  Ransomware Activity Detected                  |
+----------------------------------------------------------+
| Agent: WORKSTATION-042  |  User: john.doe                |
| Status: Investigating   |  Assignee: analyst@corp.com    |
| Created: 2024-01-15 14:32:45 UTC                         |
+----------------------------------------------------------+

Overview Section

Process Details

When the alert relates to process activity:

[Screenshot: Process details section with parent process tree]

File Details

When the alert relates to file activity:

Network Details

When the alert relates to network activity:

Related Events

Timeline of events surrounding the alert:

[14:32:45] Process: powershell.exe started (PID: 1234)
[14:32:46] File: C:\Users\...\malware.ps1 read
[14:32:47] Network: Connection to 192.168.1.100:443  <-- Alert
[14:32:48] Registry: HKCU\...\Run modified
[14:32:50] Process: cmd.exe started (child of powershell)

Click any event to view full details.

Response Actions

Available actions directly from the alert:

[Screenshot: Response actions dropdown with available options]

Severity Levels

Severity Definitions

Severity Determination

Severity is calculated based on:

Severity Adjustment

Analysts can adjust severity when context warrants:

1. Click Change Severity in alert actions
2. Select new severity
3. Enter justification (required)
4. Click Save

Adjustments are logged in the audit trail.

Alert Workflow

Status Definitions

Standard Workflow

    Open
      |
      v
  Acknowledged  (Analyst reviews alert)
      |
      v
  Investigating  (Active investigation)
      |
      +-------+-------+
      |               |
      v               v
  Resolved       Escalated
  (Closed)       (Create Investigation)

Acknowledge Alert

Mark alert as reviewed:

1. Select alert(s)
2. Click Acknowledge
3. Optionally add note
4. Click Confirm

Or use keyboard shortcut: A

Assign Alert

Assign to analyst:

1. Click Assign in alert actions
2. Select analyst from dropdown
3. Optionally add assignment note
4. Click Assign

Self-assign: Click Assign to Me

[Screenshot: Assignment dropdown with team members]

Start Investigation

Begin formal investigation:

1. Click Investigate
2. Investigation status is set
3. Alert is auto-assigned if unassigned

Resolve Alert

Close the alert:

1. Click Resolve
2. Select resolution:

• True Positive: Confirmed threat, action taken
• True Positive - Benign: Real activity, authorized
• False Positive: Detection error
• Not Applicable: Alert not relevant

1. Enter resolution notes
2. Click Resolve

[Screenshot: Resolution dialog with options and notes field]

Resolution Notes

Document investigation findings:

• What was detected
• Actions taken
• Root cause (if determined)
• Recommendations

Resolution notes support Markdown formatting.

Bulk Alert Operations

Selecting Alerts

• Individual: Click checkbox next to alert
• Page: Click header checkbox
• All Matching: Click "Select all X alerts" link
• Shift-Click: Select range

Available Bulk Operations

Executing Bulk Operations

1. Select alerts using checkboxes
2. Click action in bulk toolbar
3. Configure operation parameters
4. Review confirmation:

• Number of affected alerts
• Operation details

1. Click Confirm

[Screenshot: Bulk operation confirmation with alert count]

Bulk Acknowledge

1. Select alerts
2. Click Acknowledge
3. Optionally add note (applies to all)
4. Confirm

Bulk Resolve

1. Select alerts
2. Click Resolve
3. Select resolution type
4. Enter resolution notes
5. Confirm

Note: Bulk resolve applies the same resolution to all selected alerts. For mixed resolutions, use individual resolution.

Alert Suppression Rules

Suppression rules automatically suppress alerts matching specific criteria, reducing noise from known-good activity.

Viewing Suppression Rules

Navigate to Alerts > Suppression Rules tab.

[Screenshot: Suppression rules list with status indicators]

Creating Suppression Rules

From Alert

1. Open alert details
2. Click Suppress Similar
3. Review pre-filled criteria
4. Modify as needed
5. Enter rule name and description
6. Set expiration (optional)
7. Click Create

[Screenshot: Create suppression rule dialog from alert]

From Scratch

1. Click Create Rule
2. Define match criteria:

• Rule name/ID
• Process path
• File path
• Command line pattern
• Agent group
• User

1. Enter rule name and description
2. Set expiration
3. Click Create

Suppression Criteria

Available match fields:

Suppression Best Practices

1. Be Specific: Use narrow criteria to avoid over-suppression
2. Set Expiration: Review suppression rules periodically
3. Document Reason: Include why activity is benign
4. Monitor Usage: Track suppression counts
5. Audit Regularly: Review suppressed alerts for changes

Editing Suppression Rules

1. Click rule name
2. Modify criteria or settings
3. Click Save

Disabling vs. Deleting

• Disable: Temporarily stop suppression, preserve rule
• Delete: Permanently remove rule

Disabled rules can be re-enabled; deleted rules must be recreated.

Suppression Reports

View suppression effectiveness:

1. Navigate to Reports > Suppression
2. Select time range
3. View:

• Alerts suppressed per rule
• Suppression trends
• Top suppression rules

Alert Notifications

Notification Channels

Configure how alerts are delivered:

Notification Rules

Create rules for alert routing:

1. Navigate to Settings > Notifications
2. Click Create Rule
3. Define conditions:

• Severity >= High
• Agent group = Production
• Category = Ransomware

1. Select notification channels
2. Configure recipients
3. Click Save

[Screenshot: Notification rule builder with conditions and channels]

Escalation Policies

Configure automatic escalation:

Alert Analytics

Alert Trends

View alert patterns over time:

• Volume by severity
• Volume by category
• Detection source distribution
• Agent distribution
• Resolution trends

[Screenshot: Alert analytics dashboard with trend charts]

SLA Metrics

Track response time performance:

False Positive Rate

Monitor detection accuracy:

+------------------------------------------+
|  FALSE POSITIVE RATE (30 days)           |
+------------------------------------------+
|  Overall:          12%                   |
|  YARA Rules:        8%                   |
|  Sigma Rules:      10%                   |
|  ML Detections:    15%                   |
|  Behavioral:       18%                   |
+------------------------------------------+

High false positive rates indicate rule tuning needed.

Export and Integration

Export Alerts

1. Apply filters
2. Click Export
3. Select format:

• CSV: Spreadsheet analysis
• JSON: API/programmatic use
• PDF: Formal reporting

1. Select fields
2. Click Export

SIEM Integration

Forward alerts to SIEM:

1. Navigate to Settings > Integrations
2. Configure SIEM connector:

• Splunk
• Elastic
• Microsoft Sentinel
• QRadar
• Chronicle

1. Map alert fields
2. Test connection
3. Enable forwarding

API Access

Query alerts programmatically:

# List alerts
curl -X GET "https://api.tamandua.io/v1/alerts?severity=critical&status=open" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Get alert details
curl -X GET "https://api.tamandua.io/v1/alerts/{alert_id}" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Update alert status
curl -X PATCH "https://api.tamandua.io/v1/alerts/{alert_id}" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"status": "investigating"}'

Next Steps

• Investigations - Conduct threat investigations
• Live Response - Execute remote commands
• Agent Management - Manage endpoints
• Dashboard Guide - Monitor alerts at scale