Skip to main content
Syteca ships with a set of default alerts that trigger on common categories of forbidden activity — fraudulent actions on Windows and Linux Clients, data leakage via cloud services, illicit website categories, and non-work-related applications and websites. The default alerts are enabled by default but not assigned to any Clients — assign them to the Clients you want to monitor before they take effect. For the alert workflow (creating, editing, assigning, deleting), see Alerts. For the rule-engine reference, see Alert rules.

​
How default alerts work

  • Added automatically when the Syteca Application Server is installed or updated.
  • Risk level: High by default for every default alert.
  • Enabled, not assigned — visible on the Alerts page, but won’t trigger until you assign Clients via Edit Alert or Manage Multiple Alerts.
You can edit any default alert just like any other alert:
  • Enable / disable
  • Change the risk level
  • Configure notification options (email, tray, on-screen warning)
  • Enable additional actions (block user, kill process)
  • Delete
To hide all default alerts on the Alerts page (to focus on custom ones), select Hide Default in the Hide None drop-down at the top of the Alerts page. Default alerts are organized into four categories.

​
Fraudulent Activity

​
Data Leakage

​
Potentially Illicit Activity

Alerts

Assign default alerts to Clients, edit them, configure response actions.

Alert rules reference

Build custom alerts following the patterns the defaults illustrate.

USB Devices

The complementary detection layer for physical-channel data movement.

File upload monitoring

A focused alternative to the browser-based default alerts above.