> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts

> Syteca alerts: real-time and batched detection of forbidden user activity — across Windows, macOS, and Linux Clients — with email, tray, on-screen warning, automatic blocking, or process kill response actions.

## Detection that actually wakes someone up

Recording user activity is useful in retrospect — to investigate something that already happened. The harder problem is detection in real time: knowing the *moment* a user does something forbidden, while the recording is still being captured, so the security team can intervene before the data is gone. Most monitoring tools eventually surface forbidden activity in a report somewhere; the question is how fast and how loudly.

**Syteca alerts** sit between the two: a flexible rule engine with parameters covering Windows, macOS, and Linux activity (applications, URLs, keystrokes, clipboard, file uploads, Linux commands, Active Directory group membership), four response actions (email, tray notifications, on-screen warning, automatic block / process kill) — all configured inside the same Management Tool, against the same Client agents you've already deployed, with no second product required.

<Info>
  **Use Syteca alerts when you need to:**

  * Detect **insider threats** in real time — credential abuse, data exfiltration, privileged action outside normal patterns.
  * Automate **incident response** by combining alert detection with [user blocking](/docs/session-monitoring/block-on-alert) or process kill — no human latency.
  * Surface **compliance violations** (PCI DSS forbidden data access, HIPAA unauthorized PHI viewing, ISO 27001 access policy deviations) as both audit trail and active intervention.
  * Layer **defense-in-depth** with [UEBA](/docs/session-monitoring/ueba/overview): UEBA catches *deviation from normal*, alerts catch *defined forbidden activity*. Together they cover both halves of the detection space.
  * Get started **without designing rules from scratch** — Syteca ships with [default alerts](/docs/session-monitoring/default-alerts) for fraud indicators, data leakage, illicit websites, and non-work activity.

  **Pair it with [Block on alert](/docs/session-monitoring/block-on-alert)** — alerts handle detection; blocking handles immediate response. The complete detect-and-stop pipeline lives in one platform.
</Info>

Alerts have two complementary uses:

| Use                    | Pattern                                                                                                                                                          |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Immediate response** | Detect a forbidden action and respond at machine speed — email + tray + on-screen warning + automatic block or process kill.                                     |
| **Delayed response**   | Detect a batch of forbidden actions across many Clients, then analyze and respond. Tune the [Global Alert Settings](#global-alert-settings) to control batching. |

<Note>
  This page covers managing alert rules. For the **catalog** of alert rules that ship preconfigured with Syteca, see [Default alerts](/docs/session-monitoring/default-alerts). For the **rule-engine reference** (parameters, comparison operators, regex, logical operators), see [Alert rules](/docs/session-monitoring/alert-rules). For triaging alert events after they trigger, see [the Alerts events tab](/docs/session-monitoring/alerts-events).
</Note>

## Open the Alerts page

<Frame caption="The Alerts page — every alert rule in one grid, with risk-level color coding and current state visible at a glance.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/session-monitoring/alerts/alerts-page-grid.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=159ff704e916a2eccd9f630dbf96c74e" alt="Alerts page grid showing default and custom alerts with Risk color icons, Name, State, Assigned to, Notification, and Email Recipient columns" width="1899" height="1000" data-path="images/session-monitoring/alerts/alerts-page-grid.png" />
</Frame>

Sign in to the Management Tool, then click **Alerts** in the left navigation. The page lists every alert in the system with these columns:

| Column                  | Shows                                                                                                                                 |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **Select** *(checkbox)* | Select alerts for [Bulk Action](#bulk-action).                                                                                        |
| **Risk**                | The risk level — **red** for Critical, **orange** for High, **blue** for Normal.                                                      |
| **Name**                | The alert's name.                                                                                                                     |
| **Description**         | A description of the alert.                                                                                                           |
| **Assigned to**         | The Clients / Client groups the alert is assigned to.                                                                                 |
| **State**               | Whether the alert is enabled.                                                                                                         |
| **Notification**        | How investigators get notified — email or the [Syteca Tray Notifications application](/docs/administration/deployment/tray-notifications). |
| **Email Recipient**     | The email addresses notified when the alert triggers.                                                                                 |
| **Edit Alert** *(icon)* | Click to edit the alert.                                                                                                              |
| **View Alert** *(icon)* | Click to open the [Alerts events tab](/docs/session-monitoring/alerts-events), filtered to this alert.                                     |

### Filter and search

* **Search box** at the top of the page — find an alert by name or part of a name.
* **Hide None** drop-down at the top left — switch to **Hide Disabled**, **Hide Default**, or **Hide Enabled** to filter the list.

<Note>
  All alert management operations (add, edit, delete, assign, import/export, enable/disable, global settings) require the [administrative Client Installation and Management permission](/docs/administration/users/administrative-permissions).
</Note>

## Add an alert

<Steps>
  <Step title="Open Add Alert">
    On the **Alerts** page, click **Add** in the top right.
  </Step>

  <Step title="Set the alert properties">
    In the **Properties** section at the top:

    * Select the **Enabled** checkbox.
    * Enter a unique **Name** for the alert.
    * Optionally enter a **Description** (up to 500 characters).
    * Select the risk level — **Normal**, **High**, or **Critical**.
  </Step>

  <Step title="Define the rules">
    In the **Rules** section, define what triggers the alert. Each rule has:

    * A **parameter** (e.g. URL, Application, Keystrokes, Command, etc.).
    * A **comparison operator** (Equals, Like, Not equals, Not like, Matches Regex).
    * A **value** to compare against.

    Click **+ Or** or **+ And** to add additional rules.

    <Tip>
      For the full reference of available parameters, comparison operators, regex syntax, and worked rule examples, see [Alert rules](/docs/session-monitoring/alert-rules).
    </Tip>

    <Note>
      When multiple rules are defined in one alert, **rules of the same type combine with OR logic**, and **rules of different types combine with AND logic**. See [Logical operators](/docs/session-monitoring/alert-rules#logical-operators-and-multiple-rules) for the full semantics.
    </Note>
  </Step>

  <Step title="Assign Clients">
    In the **Assigned Clients** and **Assign Client Groups** sections, click **Add** to pick the Clients and Client groups the alert applies to.

    <Tip>
      Use the **Search box** to find specific Clients or groups by name.
    </Tip>
  </Step>

  <Step title="Configure actions">
    In the **Actions** section at the bottom, choose one or more response actions:

    | Action                                               | Effect                                                                                                                                                    |
    | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | **Send emails to**                                   | Email recipients when the alert triggers. Separate addresses with semicolons.                                                                             |
    | **Show warnings in Tray Notifications application**  | Pop-up alert in the Windows notification area, via [Syteca Tray Notifications](/docs/administration/deployment/tray-notifications).                            |
    | **Show warning message to user**                     | On-screen warning to the user when the alert triggers. Use the default text or customize it.                                                              |
    | **Additional Actions → Block user on all computers** | Automatically [block the user](/docs/session-monitoring/block-on-alert#block-automatically-when-an-alert-triggers) across all Clients. *Windows Clients only.* |
    | **Additional Actions → Kill application**            | Forcibly stop the detected application or process. *Windows and macOS Clients only.*                                                                      |

    <Warning>
      Email delivery requires [Email Sending Settings](/docs/administration/configuration/email-sending-settings) to be configured.
    </Warning>
  </Step>

  <Step title="Save">
    Click **Finish** in the bottom right. The alert appears on the Alerts page and starts evaluating activity immediately.
  </Step>
</Steps>

## Edit an alert

<Frame caption="The Rules section of an alert — define what activity triggers the alert by combining parameters, comparison operators, and values with + Or / + And.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/session-monitoring/alerts/add-alert-rules-section.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=b7c45f800d0fd364135f03be180a0e1d" alt="Add Alert page showing the Rules section with two example rules connected by AND, showing parameter, comparison operator, and value fields" width="1899" height="1000" data-path="images/session-monitoring/alerts/add-alert-rules-section.png" />
</Frame>

<Tabs>
  <Tab title="One alert">
    On the **Alerts** page, click the **Edit Alert** icon next to the alert. Edit the properties, rules, assigned Clients, and actions the same way as when [adding](#add-an-alert) it. Click **Finish** to save.
  </Tab>

  <Tab title="Multiple alerts (Manage Multiple)">
    <Steps>
      <Step title="Open Manage Multiple Alerts">
        Click the **Alerts** drop-down arrow at the top of the page, then select **Manage Multiple Alerts**.
      </Step>

      <Step title="Select alerts">
        On the **Alert Selection** tab, select the checkboxes next to the alerts to edit. Optionally click **Enable/Disable** next to specific alerts on the right. Click **Next**.
      </Step>

      <Step title="Assign Clients">
        On the **Assigned Clients** tab, select the Clients and Client groups to assign these alerts to. Click **Next**.
      </Step>

      <Step title="Set actions">
        On the **Actions** tab, configure notifications and additional actions as in [Add an alert](#add-an-alert) Step 5. Click **Finish**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Enable or disable alerts

To stop receiving notifications about an alert without deleting it, disable it instead.

<Tabs>
  <Tab title="One alert">
    Open the alert with the **Edit Alert** icon, then deselect the **Enabled** checkbox in the Properties section. Click **Finish**. Re-select the checkbox to re-enable.
  </Tab>

  <Tab title="Multiple alerts (Bulk Action)">
    On the **Alerts** page, select the checkboxes next to the alerts. Click **Bulk Action** in the top left, then choose **Enable** or **Disable**.
  </Tab>

  <Tab title="Multiple alerts (Manage Multiple)">
    Open the **Alerts** drop-down → **Manage Multiple Alerts**. Click **Enable/Disable** next to specific alerts, or use the **Enable All / Disable All** column header to apply to all.
  </Tab>
</Tabs>

## Assign alerts to Clients

Three different entry points for the same operation — pick whichever workflow fits where you are in the product.

<Tabs>
  <Tab title="While editing one alert">
    <Steps>
      <Step title="Open the alert">
        Click the **Edit Alert** icon next to the alert on the Alerts page.
      </Step>

      <Step title="Pick Clients">
        Scroll to the **Assigned Clients** section and select the Clients and Client groups.
      </Step>

      <Step title="Save">
        Click **Finish**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="While managing multiple alerts">
    <Steps>
      <Step title="Open Manage Multiple Alerts">
        Click the **Alerts** drop-down → **Manage Multiple Alerts**.
      </Step>

      <Step title="Select alerts">
        On the **Alert Selection** tab, pick the alerts to assign. Click **Next**.
      </Step>

      <Step title="Pick Clients">
        On the **Assigned Clients** tab, pick the Clients and Client groups. Click **Next**, then **Finish**.

        <Tip>
          Use the **Search box** at the top and **Apply Filters** button to find specific Clients or groups by name.
        </Tip>
      </Step>
    </Steps>
  </Tab>

  <Tab title="While editing a Client / Client group">
    <Steps>
      <Step title="Open the Client">
        Click **Clients** in the left navigation. Click the Client name in the **Client Name** column — or select the **Client Groups** tab and click a group name in the **Client Group Name** column.
      </Step>

      <Step title="Pick alerts">
        On the **Editing Client** (or **Editing Client Group**) page, select the **Assigned Alerts** tab and pick the alerts to assign.
      </Step>

      <Step title="Save">
        Click **Finish**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Import and export alerts

Alerts can be exported to an XML file (for backup, version control, or migration between Syteca deployments) and re-imported elsewhere.

<Tabs>
  <Tab title="Export">
    <Steps>
      <Step title="Open Export Alerts">
        Click the **Alerts** drop-down at the top of the page, then select **Export Alerts**.
      </Step>

      <Step title="Pick alerts">
        On the **Export Alerts** page, select the checkboxes next to the alerts to export.
      </Step>

      <Step title="Download">
        Click **Export** in the bottom right. The `Alerts.xml` file containing the selected alerts and their parameters downloads to your computer.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Import">
    <Steps>
      <Step title="Open Import Alerts">
        Click the **Alerts** drop-down, then select **Import Alerts**.
      </Step>

      <Step title="Pick a file">
        On the **Import Alerts** page, click **Choose File** and select the `.xml` file. Click **Open**, then **Add** to the right of the file name.
      </Step>

      <Step title="Configure imported alerts">
        Imported alerts are added enabled by default, but **not assigned to any Clients**. Click **Define Imported Alerts Settings** to assign them and configure notification options.

        <Note>
          If Syteca already contains an alert with the same ID as one being imported, the existing alert is **updated** with the imported parameters.
        </Note>
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Delete alerts

<Tabs>
  <Tab title="One alert">
    Open the alert with the **Edit Alert** icon, then click **Delete Alert** in the bottom left of the Edit Alert page. Click **Delete** in the confirmation.
  </Tab>

  <Tab title="Multiple alerts (Bulk Action)">
    On the **Alerts** page, select the checkboxes next to the alerts. Click **Bulk Action** in the top left, choose **Delete**, then click **Delete** in the confirmation.
  </Tab>
</Tabs>

<Note>
  When you delete an alert, all alert events that were triggered by it are no longer marked as alert events. The session recordings remain, but the alert markers are removed.
</Note>

## Bulk Action

Select multiple alerts with the checkboxes (or the **Select All** checkbox in the column header), then click **Bulk Action** in the top left for these options:

* **Enable** / **Disable** — turn the selected alerts on or off.
* **Delete** — remove the selected alerts entirely.

## Global Alert Settings

Global Alert Settings control **email batching** across all alerts — useful to prevent alert fatigue when a single rule (or related rules) fires repeatedly within a short window.

<Steps>
  <Step title="Open Global Alert Settings">
    Click the **Alerts** drop-down at the top of the Alerts page, then select **Global Alerts Settings**.
  </Step>

  <Step title="Configure the minimum interval">
    Set **Minimal interval between the same alert events in one session (min)** — for example, set to `10` so that if a user opens MS Word and keeps using it, you receive one notification every 10 minutes instead of a stream of them.
  </Step>

  <Step title="Choose batching mode">
    Pick one:

    * **Send notifications on every alert event** — immediate, one email per event.
    * **Send batch notification every (min)** — accumulate events in time windows; one email per window.

    <Note>
      With batched mode, the timing window starts from Application Server startup. Notifications then send at the configured interval.
    </Note>
  </Step>
</Steps>

## Where alert events surface

Once an alert triggers, the event information appears in five different places across the Management Tool. Choose the surface(s) that fit your workflow:

| Surface                                                                                 | What you see                                                                                                                                                                                                                                                                                                                                                                  |
| --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **[Alerts events tab](/docs/session-monitoring/alerts-events)**                              | Central list of every alert event with risk-level icon, status workflow (New → In Progress → Confirmed Risk / False Alarm / Resolved), and notes.                                                                                                                                                                                                                             |
| **[Session Viewer](/docs/session-monitoring/player/overview)**                               | Alert names appear in the **Alert/USB Rule** column of the Metadata grid, color-coded by risk level. The Alert ID appears in the Details area when the record is selected.                                                                                                                                                                                                    |
| **[Client Sessions list](/docs/session-monitoring/sessions-list)**                           | Sessions containing alert events are marked in the **Alerts** column, with the icon color reflecting the highest-risk alert in the session.                                                                                                                                                                                                                                   |
| **[User Activity Dashboards](/docs/session-monitoring/dashboards/user-activity-dashboards)** | Aggregate views of alerts triggered within a time period, including counts and lists of events.                                                                                                                                                                                                                                                                               |
| **Email notifications**                                                                 | If **Send emails to** is enabled on the alert, each email contains Alert ID, Alert name, Description, Who/What/When/Where, the rule parameter and value, and an **Open Session** link into the [Session Viewer](/docs/session-monitoring/player/overview) at the alert moment. Customize subjects on the **Configuration → Customization** tab, **Custom Email Subjects** section. |
| **[Syteca Tray Notifications](/docs/administration/deployment/tray-notifications)**          | If **Show warnings in the Syteca Tray Notifications application** is enabled, pop-ups appear in the Windows system tray. The Tray Notifications **Journal** keeps history and links each event to the [Session Viewer](/docs/session-monitoring/player/overview).                                                                                                                  |

## Related

<CardGroup cols={2}>
  <Card title="Alert rules reference" icon="square-code" href="/docs/session-monitoring/alert-rules">
    Parameters, comparison operators, regex, logical operators, worked examples.
  </Card>

  <Card title="Default alerts catalog" icon="book-marked" href="/docs/session-monitoring/default-alerts">
    The preconfigured alerts that ship with Syteca: fraud, data leakage, illicit, non-work.
  </Card>

  <Card title="Block on alert" icon="ban" href="/docs/session-monitoring/block-on-alert">
    Automatically block users when an alert triggers — the response side of detection.
  </Card>

  <Card title="UEBA" icon="activity" href="/docs/session-monitoring/ueba/overview">
    The complementary "deviation from normal" detection — pairs with alerts.
  </Card>
</CardGroup>