An alert is a notification that at least one event of interest has occurred. The event may have security impacts or may be of interest based on some other criteria that you have defined. Alerts can be considered as possible candidates for cases.
Alerts originate from one of the following:
Trellix rules
Tuned Trellix Helix rules
Customer rules
Intel hits
Trellix Helix Analytics
Trellix Helix Sinkhole
Risk describes the overall potential risk to the organization if the alert is a true positive. It is typically used to prioritize alert verification and response activities. Alerts have one of the following risk values:
Critical
High
Medium
Low
Alerts can be in one of the following states:
Open / Reopened
Suppressed
Closed