It is important to be able to track new alerts as they are detected. Alert management displays a notification when a rule triggers an alert, and automatically adds the alert to the Alerts page. From here SOC leaders can also get an overview of the workload of each analyst, and assign new alerts to maximize the efficiency of your SOC team. You can also export the alert table.
Note
The alert notification feature is not yet available.
This workflow includes the following tasks:
Acknowledge new alerts. See Acknowledge alerts.
Assign new alerts to members of your SOC team. See Assigning alerts to an analyst.
Export alert information for reporting. See Exporting the alerts table and Export the alert timeline.