Skip to main content

Managing Alerts

Learn how to effectively manage, investigate, and resolve alerts in Containment.AI.

Alert List View​

The Alerts page shows all alerts in your organization:

Default View​

  • Sorted by newest first
  • Shows unresolved alerts by default
  • Displays severity, user, policy, and status

Quick Actions​

From the list, you can:

  • Click to view details
  • Bulk select for actions
  • Export visible alerts

Investigating Alerts​

Viewing Alert Details​

Click any alert to open the detail drawer:

  1. Header - Severity, status, and quick actions
  2. Summary - What happened and why
  3. Content - The flagged content with highlights
  4. Context - User, device, and platform info
  5. Timeline - History of changes and actions

Understanding the Match​

The content section shows:

  • Highlighted text - What triggered the policy
  • Match reason - Which policy rule matched
  • Confidence - How certain the detection is

Gathering Context​

Before taking action, consider:

  • Is this a known false positive pattern?
  • What was the user trying to accomplish?
  • Is this a repeat offense?
  • What's the business context?

Taking Action​

Acknowledge​

Mark that you've seen the alert:

  1. Click Acknowledge or press A
  2. Alert moves from New to Acknowledged
  3. Other admins see it's being handled

Resolve​

Close the alert when addressed:

  1. Click Resolve or press R
  2. Select a resolution reason:
    • True Positive - Blocked - Correctly prevented
    • True Positive - Coached - User educated
    • False Positive - Incorrect trigger
    • Exception Granted - Allowed with approval
  3. Add optional notes
  4. Click Confirm

Dismiss​

For alerts that don't need action:

  1. Click Dismiss or press D
  2. Select reason:
    • False positive
    • Duplicate
    • Test data
    • Not actionable
  3. Confirm dismissal

Escalate​

Forward to another team member:

  1. Click Escalate
  2. Select assignee
  3. Add context notes
  4. Submit

Adding Notes​

Document your investigation:

  1. Click Add Note in the detail view
  2. Enter your observations
  3. Notes are timestamped with your name
  4. Visible to all admins

Example notes:

  • "Contacted user - training data, not real PII"
  • "Working with legal on this pattern"
  • "Added to exception list per ticket #1234"

Granting Exceptions​

If a user needs to bypass a policy:

  1. From the alert, click Grant Exception
  2. Configure the exception:
    • Duration - Temporary or permanent
    • Scope - This user only or team
    • Policy - Specific policy or all
  3. Add justification
  4. Approve
caution

Exceptions should be rare and well-documented. Consider adjusting the policy instead of granting many exceptions.

Bulk Actions​

Handle multiple alerts efficiently:

Selecting Alerts​

  • Click checkbox to select individual
  • Click header checkbox to select all visible
  • Shift+click for range selection

Available Bulk Actions​

  • Acknowledge - Mark all as seen
  • Resolve - Close with shared reason
  • Dismiss - Remove from active view
  • Export - Download selected data

Bulk Resolve​

  1. Select alerts with similar issues
  2. Click Bulk Actions > Resolve
  3. Choose resolution reason
  4. Add shared notes
  5. Confirm action

Alert Assignment​

Auto-Assignment​

Configure automatic assignment:

  • By severity level
  • By policy category
  • By affected team
  • Round-robin among admins

Manual Assignment​

  1. Open alert details
  2. Click the assignee field
  3. Select admin from dropdown
  4. Alert now shows in their queue

My Alerts​

Filter to see only your assigned alerts:

  1. Click My Alerts filter
  2. Or use filter: assignee:me

Workflow Integration​

Slack/Teams​

Receive alerts in your chat:

  • Configure in Integrations
  • Click alerts to open in dashboard
  • React to acknowledge quickly

Ticketing Systems​

Create tickets from alerts:

  1. Click Create Ticket in alert detail
  2. Select ticketing system (Jira, ServiceNow, etc.)
  3. Alert ID links automatically
  4. Resolution syncs back

SIEM Integration​

Forward alerts to your SIEM:

  • All alerts forwarded in real-time
  • Includes full context
  • Correlate with other security events

Performance Tips​

Efficient Triage​

  1. Start with Critical severity
  2. Use filters to group similar alerts
  3. Bulk resolve patterns
  4. Document for future reference

Reducing Volume​

If alert volume is too high:

  • Review policy sensitivity settings
  • Add legitimate patterns to allowlists
  • Consider policy restructuring
  • Train users on acceptable use

Time Management​

Recommended triage schedule:

  • Critical: Immediately
  • High: Within 4 hours
  • Medium: Within 1 business day
  • Low: Weekly review

Reporting​

Alert Reports​

Generate reports showing:

  • Alert volume over time
  • Resolution rates
  • Top triggered policies
  • User patterns

Export Options​

Export alert data as:

  • CSV for spreadsheets
  • JSON for systems integration
  • PDF for compliance documentation