Creating new alerts

As stated in the section Editing and reviewing default alerts, existing alerts can be duplicated for an easy baseline rule that can be adapted to needs. However, if you would like to create alert rules from scratch, the following process will apply.

1. Proceed to the rule section
   
   

   

2. In the top right corner Click the “ADD RULE” button. NOTE: rules are tenant specific, please ensure that you have the correct tenant selected in the top right corner.
   

   

3. You can copy details from a template as displayed in the selection list
   

   

4. Or you can begin to manually add the relevant data. Please refer to existing rules for examples.

5. All the fields support field variables references that can be listed by pressing % when on a field and selecting the appropriate field.

6. Once complete, Click save

🔖 NOTE: Do not forget to set the Incident Response information also