Update the alert for further investigation

Update alerts with assignment and categorization information to enable effective investigation and establish tracking patterns for security events.

This task is part of a workflow defined in Alerts based on firewall events.

Open the alert detail and prepare to assign and categorize the alert for investigation.

Procedure

Step 1

Select Monitor > Alerts.

Step 2

Click an alert type name.

What to do next:

Based on your initial triage and prioritization, assign the alert and tag it:

  1. Select a user from the Assignee drop-down to assign the alert, so a user can start investigating.

  2. Select one or more Tags from the drop-down to add tags to the alert, to better categorize your alert's for future identification, as well as to try and establish long-term patterns in your alerts.

  3. Enter a Comment on this alert, then click Comment to leave comments as necessary to track your initial findings, and assist the person assigned to the alert. The alert tracks both system comments and user comments.

The alert is assigned to a specific user with appropriate tags and comments, enabling organized investigation and tracking of security events.