Skip to main content

​
Detection that actually wakes someone up

Recording user activity is useful in retrospect — to investigate something that already happened. The harder problem is detection in real time: knowing the moment a user does something forbidden, while the recording is still being captured, so the security team can intervene before the data is gone. Most monitoring tools eventually surface forbidden activity in a report somewhere; the question is how fast and how loudly. Syteca alerts sit between the two: a flexible rule engine with parameters covering Windows, macOS, and Linux activity (applications, URLs, keystrokes, clipboard, file uploads, Linux commands, Active Directory group membership), four response actions (email, tray notifications, on-screen warning, automatic block / process kill) — all configured inside the same Management Tool, against the same Client agents you’ve already deployed, with no second product required.
Use Syteca alerts when you need to:
  • Detect insider threats in real time — credential abuse, data exfiltration, privileged action outside normal patterns.
  • Automate incident response by combining alert detection with user blocking or process kill — no human latency.
  • Surface compliance violations (PCI DSS forbidden data access, HIPAA unauthorized PHI viewing, ISO 27001 access policy deviations) as both audit trail and active intervention.
  • Layer defense-in-depth with UEBA: UEBA catches deviation from normal, alerts catch defined forbidden activity. Together they cover both halves of the detection space.
  • Get started without designing rules from scratch — Syteca ships with default alerts for fraud indicators, data leakage, illicit websites, and non-work activity.
Pair it with Block on alert — alerts handle detection; blocking handles immediate response. The complete detect-and-stop pipeline lives in one platform.
Alerts have two complementary uses:
This page covers managing alert rules. For the catalog of alert rules that ship preconfigured with Syteca, see Default alerts. For the rule-engine reference (parameters, comparison operators, regex, logical operators), see Alert rules. For triaging alert events after they trigger, see the Alerts events tab.

​
Open the Alerts page

Alerts page grid showing default and custom alerts with Risk color icons, Name, State, Assigned to, Notification, and Email Recipient columns

The Alerts page — every alert rule in one grid, with risk-level color coding and current state visible at a glance.

Sign in to the Management Tool, then click Alerts in the left navigation. The page lists every alert in the system with these columns:
  • Search box at the top of the page — find an alert by name or part of a name.
  • Hide None drop-down at the top left — switch to Hide Disabled, Hide Default, or Hide Enabled to filter the list.
All alert management operations (add, edit, delete, assign, import/export, enable/disable, global settings) require the administrative Client Installation and Management permission.

​
Add an alert

1

Open Add Alert

On the Alerts page, click Add in the top right.
2

Set the alert properties

In the Properties section at the top:
  • Select the Enabled checkbox.
  • Enter a unique Name for the alert.
  • Optionally enter a Description (up to 500 characters).
  • Select the risk level — Normal, High, or Critical.
3

Define the rules

In the Rules section, define what triggers the alert. Each rule has:
  • A parameter (e.g. URL, Application, Keystrokes, Command, etc.).
  • A comparison operator (Equals, Like, Not equals, Not like, Matches Regex).
  • A value to compare against.
Click + Or or + And to add additional rules.
For the full reference of available parameters, comparison operators, regex syntax, and worked rule examples, see Alert rules.
When multiple rules are defined in one alert, rules of the same type combine with OR logic, and rules of different types combine with AND logic. See Logical operators for the full semantics.
4

Assign Clients

In the Assigned Clients and Assign Client Groups sections, click Add to pick the Clients and Client groups the alert applies to.
Use the Search box to find specific Clients or groups by name.
5

Configure actions

In the Actions section at the bottom, choose one or more response actions:
Email delivery requires Email Sending Settings to be configured.
6

Save

Click Finish in the bottom right. The alert appears on the Alerts page and starts evaluating activity immediately.

​
Edit an alert

Add Alert page showing the Rules section with two example rules connected by AND, showing parameter, comparison operator, and value fields

The Rules section of an alert — define what activity triggers the alert by combining parameters, comparison operators, and values with + Or / + And.

On the Alerts page, click the Edit Alert icon next to the alert. Edit the properties, rules, assigned Clients, and actions the same way as when adding it. Click Finish to save.

​
Enable or disable alerts

To stop receiving notifications about an alert without deleting it, disable it instead.
Open the alert with the Edit Alert icon, then deselect the Enabled checkbox in the Properties section. Click Finish. Re-select the checkbox to re-enable.

​
Assign alerts to Clients

Three different entry points for the same operation — pick whichever workflow fits where you are in the product.
1

Open the alert

Click the Edit Alert icon next to the alert on the Alerts page.
2

Pick Clients

Scroll to the Assigned Clients section and select the Clients and Client groups.
3

Save

Click Finish.

​
Import and export alerts

Alerts can be exported to an XML file (for backup, version control, or migration between Syteca deployments) and re-imported elsewhere.
1

Open Export Alerts

Click the Alerts drop-down at the top of the page, then select Export Alerts.
2

Pick alerts

On the Export Alerts page, select the checkboxes next to the alerts to export.
3

Download

Click Export in the bottom right. The Alerts.xml file containing the selected alerts and their parameters downloads to your computer.

​
Delete alerts

Open the alert with the Edit Alert icon, then click Delete Alert in the bottom left of the Edit Alert page. Click Delete in the confirmation.
When you delete an alert, all alert events that were triggered by it are no longer marked as alert events. The session recordings remain, but the alert markers are removed.

​
Bulk Action

Select multiple alerts with the checkboxes (or the Select All checkbox in the column header), then click Bulk Action in the top left for these options:
  • Enable / Disable — turn the selected alerts on or off.
  • Delete — remove the selected alerts entirely.

​
Global Alert Settings

Global Alert Settings control email batching across all alerts — useful to prevent alert fatigue when a single rule (or related rules) fires repeatedly within a short window.
1

Open Global Alert Settings

Click the Alerts drop-down at the top of the Alerts page, then select Global Alerts Settings.
2

Configure the minimum interval

Set Minimal interval between the same alert events in one session (min) — for example, set to 10 so that if a user opens MS Word and keeps using it, you receive one notification every 10 minutes instead of a stream of them.
3

Choose batching mode

Pick one:
  • Send notifications on every alert event — immediate, one email per event.
  • Send batch notification every (min) — accumulate events in time windows; one email per window.
With batched mode, the timing window starts from Application Server startup. Notifications then send at the configured interval.

​
Where alert events surface

Once an alert triggers, the event information appears in five different places across the Management Tool. Choose the surface(s) that fit your workflow:

Alert rules reference

Parameters, comparison operators, regex, logical operators, worked examples.

Default alerts catalog

The preconfigured alerts that ship with Syteca: fraud, data leakage, illicit, non-work.

Block on alert

Automatically block users when an alert triggers — the response side of detection.

UEBA

The complementary “deviation from normal” detection — pairs with alerts.