# Alerts and Incidents

## Alerts

**Alerts** are warnings generated to notify users when any significant events occur. They fire **incidents** that enable you to execute appropriate actions. Any valid search query can trigger an alert to generate incidents.

You can create an alert rule and select a mechanism to notify you of the incident. Logpoint can notify you via Email, Syslog, SNMP, HTTP, or SSH. You have the flexibility to design an alert mechanism based on your requirements.

The **Alert Rules** section in LPSM allows you to set up, manage, and perform actions on the Alert Rules on behalf of the Fabric-enabled Logpoints connected to its pools.

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FtkQDJe1RqgriCvXvDP6b%2Fimage.png?alt=media&#x26;token=0baa4929-2bc8-4822-9d47-e64aed2148f2" alt="" width="563"><figcaption><p>Alert Rules</p></figcaption></figure></div>

{% hint style="info" %}
You can perform alert rules actions individually or in bulk. However, to perform the alert rules actions in bulk, the alert rules of Fabric-enabled Logpoint instances must be compatible with each other.&#x20;
{% endhint %}

Version compatibility of the alert rules:

| **Fabric-enabled Logpoint** | **Compatible Fabric-enabled Logpoint Versions** |
| --------------------------- | ----------------------------------------------- |
| 6.11.x                      | 6.11.x                                          |
| 6.12.x                      | 6.12.x to 7.1.0                                 |
| 7.0.x                       | 6.12.x to 7.1.0                                 |
| 7.1.0                       | 6.12.x to 7.1.0                                 |
| 7.1.1, 7.1.2, 7.1.3         | 7.1.1, 7.1.2, 7.1.3                             |
| 7.2.x                       | 7.2.x                                           |
| 7.3.0                       | 7.3.0                                           |

### Select Page View&#x20;

You can view the alert rules in two ways:

1. Tabular view
2. Coverage view

<details>

<summary>Select a Page View</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.\
   ![Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FkuzwDV8ZdxU9g3oPtXHR%2Fimage.png?alt=media\&token=89b83841-1fcc-4462-8022-3acd608a9fc9)
2. **Select a view** from the drop-down.\
   ![Alert Rules View Drop-down](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FaARKEsb7KZ6sbCPwTOgC%2Fimage.png?alt=media\&token=d4788606-3b47-4d39-a6fa-a476f54f04b3)

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Only the alert rules under <strong>My Rules</strong>, <strong>Used Rules</strong>, <strong>Vendor Rules</strong>, and used <strong>Shared Rules</strong> can be viewed from the views.</p></div>
3. Select a **Pool**, a **Machine**, and a **Logpoint User**.\
   ![Select Pool, Machine and User](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FrLwWMNWeLPE81ZdUpcHm%2Fimage.png?alt=media\&token=bad04003-3171-498e-8af0-174b692c834b)
4. Click **Coverage View/Tabular View**.

</details>

**Tabular View**

Select **Tabular View** to display additional columns that list the **Log Source**, **Attack Category**, and **Attack Tag** of the alert rules. You can also see whether the alert rule is active or inactive in the **Name** column.

{% hint style="info" %}
You can filter alert rules by multiple log sources from Logpoint v7.4.0 and later, prior to v7.4.0 you can only apply a single alert rule as a filter.
{% endhint %}

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FWDbyCrbW9BB5NiAjXCkd%2Fimage.png?alt=media&#x26;token=fe76d9aa-38fb-4fb7-ac03-19ab6876922f" alt="" width="375"><figcaption><p>Tabular View of Alert Rules</p></figcaption></figure></div>

**Coverage View**

Select **Coverage view** to view the categorization of the alert rules based on various attack categories and attack tags associated with the attack tactics, attack techniques and, attack sub-techniques of the MITRE attack framework. The attack categories are displayed as column headers with the respective attack tags listed under. You can further drill down the attack tags.

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FGAnFV7A4Ft7Sa9DDOEYU%2Fimage.png?alt=media&#x26;token=b97a3837-20c5-47c4-adec-938b6d6d7de5" alt="" width="375"><figcaption><p>Coverage View of Alert Rules</p></figcaption></figure></div>

You can click the attack tags to view the list of associated alerts rules. The alert rules are listed as similar to the tabular view.

{% hint style="info" %}

* The total count of active alerts rules with respect to the total number of alert rules is highlighted in green under the attack tag.
* The total count of alert rules doesn’t change when the vendor alert rules are used, however the used vendor alerts will be listed along with the vendor alert rule in the dialog box.
  {% endhint %}

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FhYXNjdWSwCscJprL1eA2%2Fimage.png?alt=media&#x26;token=aed9c43f-6fd8-4360-a7f5-141006595def" alt="" width="375"><figcaption><p>List of Alert Rules Associated with the Attack Tag</p></figcaption></figure></div>

Click the **Help** (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FqvQFu82kMCas6Ma7PSTb%2Fimage.png?alt=media&#x26;token=b59d3644-71b0-4bd8-b851-79db321ec076" alt="" data-size="line">) icon on the top of the dialog box to view the description of the attack tag associated with the attack techniques and sub-techniques of the MITRE attack framework.<br>

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F9EZQcnCFpHdT5xs0gQ85%2Fimage.png?alt=media&#x26;token=64796e61-9cee-4ee1-9c81-eb920ab9deec" alt="" width="375"><figcaption><p>Description of the Attack Tag</p></figcaption></figure></div>

**View Actions**

The tabular/coverage view consists of an action bar allowing you to perform the following actions:

**Pool**

Shows the pool name that you have selected for the view. You can click the pool name to open the **Select Pool, Machine and User** pop-up where you can make the necessary changes.

**Machine**

Shows the name of the machine that you have selected for the view. You can click the machine name to open the **Select Pool, Machine and User** pop-up where you can make the necessary changes.

**User**

Shows the name of the user that you have selected for the view. You can click the user name to open the **Select Pool, Machine and User** pop-up where you can make the necessary changes.

**Close view**

Allows you to close the tabular/coverage view and return to the **My Alert Rules** page.

**Add**

Allows you to create a new alert rule using the alert creation wizard. Go to [Creating an Alert Rule](#create-alert-rules) for more details.

**Select Log Source**

Allows you to filter the alert rules according to the log sources using the drop-down. The drop-down is only available for tabular view.

**Filter Active Rules**

Allows you to view only the active alert rules by selecting the checkbox. This checkbox is only available for tabular view.

**More**

The **More** drop-down near the top-right corner of the tabular view page lists additional actions.<br>

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FtBwMRz6MU1xMXIIJzKLY%2Fimage.png?alt=media&#x26;token=c87eaf8c-56e2-4707-8a04-a9a4885648d0" alt="" width="223"><figcaption><p>More Drop-Down</p></figcaption></figure></div>

* The **Activate Selected Alert Rules** option lets you activate multiple alert rules at once.
* The **Deactivate Selected Alert Rules** option lets you deactivate multiple alert rules at once.

{% hint style="info" %}
Vendor rules cannot be activated or deactivated from the **Tabular View**.
{% endhint %}

### Create Alert Rules

<details>

<summary>Create Alert Rules</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click **Add**.\
   ![Add Alert Rule](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FuOzCxF7QJzduRMIt2zHx%2Fimage.png?alt=media\&token=07420883-ad70-4a2b-a993-537a39d33562)

   \
   ![Logpoint Selection - Step 1](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FGLmyR45Y9CxFyz9bDY12%2Fimage.png?alt=media\&token=0820fd49-ed1c-4116-853b-d5f321117e89)
3. Select **Pool**, **Machine**, and **Logpoint user** in the **Select Logpoint** field where you want to create the **Alert Rule**.
4. Click **Next**.\
   ![Create Alert - Step 2](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2Fyc3TJ2DIxPA5YZou325E%2Fimage.png?alt=media\&token=47c4cc42-9122-49d1-8c42-2091c09551e3)
5. Enter the **Name** of the alert.
6. Enter the **Query** for which you want the alert to trigger an incident. You can either manually enter a search query or pick a query from the **Advanced Query Picker** using the **Select** option.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>In <strong>Data Privacy Module</strong> enabled systems, the values for all the fields configured under the <strong>Data Privacy Module</strong> appear in encrypted form. For queries using specified values for the configured fields, Logpoint does not generate any incidents. However, for the queries specified with <strong>all values</strong>, the incident is generated with encrypted values of the fields.</p><p>For example, if you have configured the <strong>device_name</strong> field under the Data Privacy Module, then the query <strong>device_name=localhost</strong> does not generate any incident. However, the query <strong>device_name=*</strong> generates incidents with encrypted values.</p></div>
7. Select the **Repos** that you want the alert rule to monitor for the matching alert condition.
8. In the **Limit** field, enter the maximum number of logs to retrieve using the entered **Query**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The <strong>Limit</strong> selection field disappears if you enter an aggregation query in the <strong>Query</strong> field.</p></div>
9. Enter a **Description**.
10. Enter a **Time-range** of the alert.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><ul><li>You can set a time range of either only minutes or only day and hour.</li><li>The maximum limit for the <strong>day</strong> time range is 30.</li></ul></div>
11. Select **Define Search Interval** to apply a time interval to the search.
12. Enter the **Search Interval** in minutes. For example, if you set the search interval to two, Logpoint performs the search every two minutes. If you have used a pattern finding query in the **Query** field, the search is not performed in the specified **Search Interval** even if you select the **Enable Search Interval** checkbox as **Search Intervals** do not work with pattern finding.
13. Enable **Delay Alert** to define the delay threshold.
14. Enter the **Delay Threshold** in minutes. Logpoint waits until the delay threshold has passed before processing the logs, to ensure that all relevant logs are collected before generating the incidents.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><ul><li>Delay Threshold can only be used with <strong>log_ts</strong> based searches. The <strong>col_ts</strong> based queries may not consider all logs while generating alerts due to log transmission and processing delays.</li><li>While defining <strong>Search Interval</strong> and <strong>Delay Threshold</strong>, we recommend you define the delay threshold in the multiple of the search interval.</li><li>The maximum value of the Delay Threshold can be up to 24 hours.</li></ul></div>
15. Check **Flush On Trigger** if you want the next alert to be triggered only by a new set of events.
16. Select **Alert Throttling** to ensure that multiple alerts are not created for the same set of values for a specified time.
17. Enter the **Field** and the time in **Minutes**. Once an alert is triggered for a value of the particular **Field**, it does not trigger another alert for the same value specified in **Minutes**.
18. Click **Next**.\
    ![](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FqdA9eZMFnjsOb03vai4C%2Fimage.png?alt=media\&token=e358eefa-c3ea-4367-8d95-303f6cf5a06a)
19. Select the **Attack Tag** from the drop-down. You can select multiple tags to categorize the alert.
20. **Attack Category** is selected based on the associated **Attack Tags** selected.
21. To categorize the alert rule, use both **Field** and **Value** to add metadata to the alert rule.
    * You can use letters, numbers, underscores (\_), or a combination. Always start with a letter.
    * You can add as many metadata rows as you like. Click ADD NEW VALUE.
    * You cannott use the same Field name for two different values.
    * You cannot use Logpoint Jinja placeholders as categorization metadata. Go to [Logpoint Reserved Jinja Placeholders](https://app.gitbook.com/s/ZJI3Yx2mS6Pn4JEd0IKM/readme/a_work-with-your-log-data/alert-detections/jinja_placeholders) to learn more.
22. Select **Log Sources** from the drop-down or enter new log sources associated with the alert rule. New log sources are also updated in the drop-down after submission.
23. Click Next.\
    ![Alert Ownership - Step 4](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F4EKVVjR5dvhhs4IJ1TWq%2Fimage.png?alt=media\&token=40664624-6e39-45b3-9fc9-c4c73862bb9b)
24. Select the **Condition**, **Risk**, and **Risk Calculating Function** from the drop-downs.\
    \
    Based on the **Risk** level and **Risk Calculation Function**, Logpoint calculates the **Risk Value** of the alerts and incidents they generated. If the search result of the query contains the *device\_ip*, the **Risk Calculation Function** takes the **Risk Value** of the devices and **Risk level** of the alert as arguments.\
    \
    For example:\
    If the **Risk** level of an alert is **Medium**, **Risk Calculation Function** is **Maximum**, and the **Risk Value** of its associated device(s) is **Critical**, the **Risk Value** of the generated alert and incident is: *Maximum(Risk level, Risk value of device(s))*. That means the Risk value of the incident is Critical.\
    The risk value of a device is calculated from the values of Confidentiality, Availability, and Integrity.\
    Whereas for search queries with pipeline commands or without *device\_ip* in the search results, the *Risk Value* of the alert and its generated incident(s) is equal to the **Risk** level of the alert.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><ul><li><strong>Condition</strong> is the number of logs the search will return. Setting a limit controls the number of logs for the search. The number of logs you select should not exceed the previously set limit. Logpoint compares the limit value to the value set in the condition to the added alert rule. For example, you set the limit to 30 logs. Then you need to make sure that your condition is 30 or less. It cannot be greater than 30.</li><li><strong>Average</strong> returns the average of the sum of <em>Confidentiality</em>, <em>Availability</em>, <em>Integrity</em>, and <em>Risk</em> divided by the number of times they happened. <strong>Maximum</strong> returns the highest value and <strong>Minimum</strong> returns the lowest.</li></ul></div>
25. Click **Next**.\
    If required, you can assign an Alert Rule to an individual Logpoint user by selecting none of the Incident User Groups in the Manageable by tree node structure. For more information on Incident User Groups, refer to the [Incident User Groups in Logpoint](https://app.gitbook.com/s/ZJI3Yx2mS6Pn4JEd0IKM/readme/user-configuration/user-access-management#incident-user-groups).\
    ![Alert Ownership - Step 5](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FTfFMGoYosEUBqzDhTX4O%2Fimage.png?alt=media\&token=b44c69cc-c225-4652-a694-72f8339f3e0f)
26. Select a user from the **Assigned to** drop-down. You need to assign the Alert rule to a user or user group. To select an individual user, select them in **Assigned to**. You can assign an Alert Rule to yourself by deselecting all of the [Incident User Groups](https://app.gitbook.com/s/ZJI3Yx2mS6Pn4JEd0IKM/readme/user-configuration/user-access-management#incident-user-groups) in **Manageable by**.
27. To assign the alert rule to a group, select the group in **Manageable by**.\
    \
    Users selected in both the **Assigned to** and **Manageable by** section can re-assign, comment on and view the data of the generated incident. However, only the **Assigned to** user can resolve it.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>If you do not belong to any of the <a href="https://app.gitbook.com/s/ZJI3Yx2mS6Pn4JEd0IKM/readme/user-configuration/user-access-management#incident-user-groups">Incident User Groups</a>, the <strong>Assigned to</strong> and <strong>Manageable by</strong> are hidden and in LPSM you get the following.<br><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FjJSiS99aHrrHEYu3iElt%2Fimage.png?alt=media&#x26;token=1ad95fef-6b94-46dc-b646-69acc6c16914" alt="Creating Alert Rule - Step 5"></p></div>
28. LPSM allows you to view the details of the incidents triggering the alert in a specific format. Enable **Apply Jinja template** and enter the template in the **Template syntax** field.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><ul><li>To view the details of the incident in the specified Jinja format, click the <strong>Incident Data</strong> icon of the incident generated by the alert rule.</li><li>While including timestamp data in the Jinja template, it is mandatory to include the <strong>datetime</strong> filter. The timestamp is displayed in raw epoch format if the <strong>datetime</strong> filter is not included.</li><li>Select <strong>Toggle Simple View</strong> to enable or disable the advanced text editor.</li></ul></div>

    \
    ![Creating Alert Rule - Step 6](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FhcHuz3wjpcYVsco5fETN%2Fimage.png?alt=media\&token=4c4553bc-efcd-458e-a898-60e0b28acc7e)
29. If the Data Privacy Module is enabled in the system, the **Data Privacy Request** window will appear. Check the **Alert using original data** option if you want the fields in the alert to be decrypted, else, the alert will be generated with encrypted values.\
    ![Creating Alert Rule - Step 7](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FejLmrhjw1JCKG99L58Sw%2Fimage.png?alt=media\&token=a958119f-b98c-4406-8448-8486f9bb5612)
30. Click **Finish**.\
    \
    If you have checked the **Alert using original data** option, you will be notified with a confirmation message. Click **Yes** to create a data privacy request for the alert. The alert created hereby will be deactivated until the data privacy request is granted.\
    ![Data Privacy Module Confirmation](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F1R4wrWtMrIiSj3zlNP8k%2Fimage.png?alt=media\&token=46003861-64fc-40b7-ac32-d84fd1f05167)

{% hint style="info" %}

* Alert Rules can be exported as per your requirement. However, the ownership information will be lost while exporting the Alert Rule. This behavior is also observed while using the **Shared** and **Cloned** Alert Rule.
* In the Data Privacy Module enabled systems, after successfully configuring the settings for the alert by the users with **Can Request Access**, the users with **Can Grant Access** privilege will be prompted with a message regarding the request. This can be viewed under `Settings >> Configuration >> Data Privacy Module >> Pending Request`.
* Similarly, after the request is granted, the users with **Can Request Access** will be prompted with a message, which can be viewed under `Settings >> Configuration >> Data Privacy Module >> Request`. Only then will the users be able to view the alert with original data.
  {% endhint %}

After completing the configuration, LPSM shows you a notification dialog box asking whether you want to configure the notifications for the rule. Click **Yes**. Once the alert is created, you can view it under **My Rules**. The alert is also created in the Fabric-enabled Logpoint.

You can also configure or change it later by clicking the **Notification** icon from the **Actions** column of the alert rule.\
![Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FKhnvrrUhUAeH3rUo0t47%2Fimage.png?alt=media\&token=3370a0ae-5345-4bfb-a889-c4ca9348ae16)

Now, whenever a search query meets all the alerting criteria, the alert is triggered, and it generates the corresponding incident. To view the incident, click the [Incident](#incidents) tab.

</details>

### Set Up Alert Notifications&#x20;

After creating an alert rule on behalf of a Fabric-enabled Logpoint, you can set up the following notifications for the rule.

* Email notification
* SMS notification
* Syslog notification
* SNMP notification
* HTTP notification
* SSH notification

The message and command fields of the SMTP and SSH notifications support Jinja2 syntax. The message field of the Syslog notification supports Jinja syntax. For more information on how Jinja and Jinja2 syntaxes are implemented in the SMTP, SSH, and Syslog services, go to [Setting Up Alert Notifications](https://app.gitbook.com/s/ZJI3Yx2mS6Pn4JEd0IKM/readme/a_work-with-your-log-data/alert-detections#creating-an-alert-rule) in Logpoint **Alerts and Incidents**.

In LPSM v2.2.0 and later, you can

* Use the *{{lpsm\_search\_link}}* Jinja command to display the link to search for the logs that triggered the alert.
* In Fabric-enabled Logpoint, the link redirects you to the LPSM search page.
* In standard Logpoint, it redirects you to the Logpoint search page.
* To use this Jinja command, Server Alias in `System Settings >> General` must be selected and a valid value specified. be empty and specified.
* For more information on supported Jinja syntax for alert notification setup, go to [Logpoint Reserved Jinja Placeholders](https://app.gitbook.com/s/ZJI3Yx2mS6Pn4JEd0IKM/readme/a_work-with-your-log-data/alert-detections/jinja_placeholders) in Logpoint **Alerts and Incidents**.

<details>

<summary>Configure Email Notification</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Setup Notification** icon from the *Actions* column of the alert rule.
3. Select **Email Notification** and enable **Notify via email**.\
   ![Email Notification Setup](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FNbgxjV60NSY160xjJzJv%2Fimage.png?alt=media\&token=a7ead495-6bb8-48b7-b53c-521f9bef73ae)
4. In the **Notification Trigger** section:
   * Select **Automatic** to send a notification every time the alert rule is triggered.
   * Select **Manual** to manually send the notification from the [Generated Incidents](#manage-generated-incidents).
5. Enter valid email addresses under **Emails**.
6. Enter a **Subject**. Logpoint supports the following Jinja commands for the alert rules
   * `{{alert_name}}`
   * `{{detection_timestamp}}`
   * `{{risk_level}}`
   * `{rows}}`
   * `{{rows_count}}`

You can write them in a query as: `Logs from {{rows.col_type}} on date {{rows.col_ts|datetime}}`.

7. Select **Toggle Simple View** to enable or disable the advanced text editor.
8. Select **Disable Search Link** to remove the search link in the email. The search link redirects to the search page of the LPSM machine from which the email notification is configured.
9. Enter a **Message**.
10. Set the **Threshold**.
11. Select **Enable Logo** if you want to include the Logpoint logo in the email notification.
12. **Browse** for the image in the JPG/JPEG format if you want to provide a custom logo. The maximum dimension for the custom logo is 600\*400.
13. Click **Save**.

{% hint style="info" %}

* You can use the Jinja commands `{{attack_id}}`, `{{attack_tag}}`, `{{attack_category}}`, and `{{log_source}}` in the **Subject** and **Message** fields. You can also use the metadata fields associated with the alert as Jinja commands in these Jinja supported fields. If the metadata fields associated with the alert are *threatactor*, *Associated\_Malware*, and *System*, then you can use them as Jinja commands as `{{threatactor}}`, `{{Associated_Malware}}`, and `{{System}}`.
* If you do not want to include the Logpoint logo in the email, deselect **Enable Logo** and click **Save**.
* To configure the SMTP service, go to `Settings >> System >> System Settings` before sending email notifications. Go to the [SMTP](https://docs.logpoint.com/director/configure-lpsm#smtp) section for details.
  {% endhint %}

</details>

<details>

<summary>Configure SMS Notification</summary>

Before configuring SMS notification, the SMSC server must be accessible from Logpoint.

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Setup Notification** (![notification](https://docs.logpoint.com/docs/lpsm-search-and-analytics/en/latest/_images/notificationicon.png)) icon from the **Actions**.
3. Select **SMS Notification** and enable **Notify via SMS**.\
   ![SMS Notification Setup](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F6uPUuV7bzrCCHTeepDxi%2Fimage.png?alt=media\&token=33308279-9797-4108-b163-61d08eafa08f)
4. In **Notification Trigger**:
   * Select **Automatic** to send an SMS notification every time the alert rule is triggered.
   * Select **Manual** to manually send the SMS notification from the [Generated Incidents](#manage-generated-incidents).
5. Enter **SMSC Server/Port**. the SMSC server supports both hostname and IP address.
6. Enter **Username**, **Password**, and **Sender ID** of the server.
7. In **Receivers**, enter the phone numbers including the country code.
8. In **Body**, enter a template in Jinja format for the SMS.
9. Set the **Threshold** time to trigger the SMS notification after enabling it.
10. Click **Save**.

</details>

<details>

<summary>Configure Syslog Notification</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Setup Notification** icon from the *Actions* column of the alert rule.
3. Select **Syslog Notification** and enable **Notify via Syslog**.\
   ![Syslog Notification Setup](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FdOc91hIDxrUQ4fMkcdwZ%2Fimage.png?alt=media\&token=877b9e3d-d74f-4b6c-942c-892d59d257ac)
4. In the **Notification Trigger** section:
   * Select **Automatic** to send a notification every time the alert rule is triggered.
   * Select **Manual** to manually send the notification from the [Generated Incidents](#manage-generated-incidents).
5. Enter the **IP Address** and the **Port** number for the syslog receiver in the **Server/Port** textboxes.
6. Select the level of **Severity** and **Facility** from the drop-downs.
7. Enter a **Message** that gives the information about the event. You can use the Jinja template to construct a message that extracts specific information about the event.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>You can use the Jinja commands <code>{{attack_id}}</code>, <code>{{attack_tag}}</code>, <code>{{attack_category}}</code>, and <code>{{log_source}}</code> in the <strong>Message</strong> field. You can also use the metadata fields associated with the alert as Jinja commands in these Jinja supported fields. If the metadata fields associated with the alert are <em>threatactor</em>, <em>Associated_Malware</em>, and <em>System</em>, then you can use them as Jinja commands as <code>{{threatactor}}</code>, <code>{{Associated_Malware}}</code>, and <code>{{System}}</code>.</p></div>
8. Set the **Threshold**.
9. Choose either the **UDP** or the **TCP** protocol to send the Syslog Notification.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><ol><li>If you use UDP, the log message may be dropped or it may arrive out of order.</li><li>If you use TCP, the log message arrives without being dropped and in order.</li></ol></div>
10. Select the **Send each new line as separate syslog notification** checkbox to generate one syslog message for each log message in the search results. If you do not select it, all the messages within the chosen time range of the incident are compressed into one syslog message in the search results.

{% hint style="info" %}
The **Send each new line as separate syslog notification** option is useful only if the **Message** textbox contains a Jinja template with a **for loop**.
{% endhint %}

</details>

<details>

<summary>Configure SNMP Notification</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Setup Notification** icon from the *Actions* column of the alert rule.
3. Select **SNMP Notification** and enable **Notify via SNMP Traps**.\
   ![SNMP Notification Setup](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FNc2HQJWVOXd6u2wGYJ5k%2Fimage.png?alt=media\&token=c89f8efc-267b-4579-8c07-2cd64544b8a5)
4. In the **Notification Trigger** section:
   * Select **Automatic** to send a notification every time the alert rule is triggered.
   * Select **Manual** to manually send the notification from the [Generated Incidents](#manage-generated-incidents).
5. Enter the trap receiver’s **IP** address and the **Port** number.
6. Enter a valid SNMP trap or Enterprise specific **OID** (Object Identifier) in the dotted decimal format. Make sure to not use the OID with a leading dot.
7. Select either the SNMPv2c version or the SNMPv3 version according to the security level you require.

   The notification settings change according to the version you pick.

   1. **For SNMPv2c configuration**
      1. Enter the name of the **Agent** that sends the SNMP trap.
      2. Enter a passphrase in the **Community String**. The passphrase should be recognizable by the manager.
      3. Enter the OID’s corresponding value in the **Message**.
   2. **For SNMPv3c configuration**
      1. Enter the **Username**.
      2. Enter the **Authorization Key** and **Private Key**.

         <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>You can toggle the SHOW/HIDE button to show or hide the <strong>Authorization Key</strong> and <strong>Private Key</strong>.</p></div>
      3. At the **Message** tab, enter the OID’s corresponding value.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>You can use the Jinja commands <code>{{attack_id}}</code>, <code>{{attack_tag}}</code>, <code>{{attack_category}}</code>, and <code>{{log_source}}</code> in the <strong>Message</strong> field. You can also use the metadata fields associated with the alert as Jinja commands in these Jinja supported fields. If the metadata fields associated with the alert are <em>threatactor</em>, <em>Associated_Malware</em>, and <em>System</em>, then you can use them as Jinja commands as <code>{{threatactor}}</code>, <code>{{Associated_Malware}}</code>, and <code>{{System}}.</code></p></div>

   ![SNMPv3 Configuration](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FnoPJtbKrNOiwxO3NL39V%2Fimage.png?alt=media\&token=554fb6f6-c328-4ec4-91d3-180ef3644edb)
8. Set the **Threshold**.
9. Click **Save**.

</details>

<details>

<summary>Configure HTTP Notification</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Setup Notification** icon from the *Actions* column for the alert rule.
3. Select **HTTP Notification** and enable **Notify via HTTP/S**.\
   ![HTTP Notification Setup](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FVY3Sp4uQMjFTJLKzIOjs%2Fimage.png?alt=media\&token=a65d58bb-5ecf-4e2e-af94-cb4386182677)
4. In **Notification Trigger**:
   * Select **Automatic** to send a notification every time the alert rule is triggered.
   * Select **Manual** to send the notification from the [Generated Incidents](#manage-generated-incidents) manually.
5. In **Protocol**:
   * Select **HTTP** to send a notification using HTTP protocol.
   * Select **HTTPS** to send a notification using a more secure HTTPS protocol.
6. Enter either a valid IP address or domain name in the **Base URL** field.
7. Select a **Request Type** from the drop-down.
8. Enter a **Query String**. Logpoint supports the following Jinja commands for the alert rules:

   * `{{alert_name}}`
   * `{{detection_timestamp}}`
   * `{{risk_level}}`
   * `{{rows}}`
   * `{{rows_count}}`

   You can write them in a query as: `user='admin'&count={{rows_count}}`.
9. Select an authentication **Header** type.
   1. If you select **Basic Auth**, enter the required **Key** and **Password**.
   2. If you choose **API Token**, enter the required **Key** and **Value**.
   3. If you select **Bearer Token**, enter the required **Key**.
10. Enter a template for the **Body** of the HTTP notification in the Jinja format.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>You can enter the template <strong>Body</strong> only for the <strong>POST</strong>, <strong>PUT</strong>, and <strong>PATCH</strong> request methods.</p></div>
11. Set the **Threshold**. **Threshold** is a time after which next **HTTP/S notification** can be triggered.
12. Click **Save**.

</details>

<details>

<summary>Configure SSH Notification</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Setup Notification** icon from the *Actions* column of the alert rule.
3. Select **SSH Notification** and enable **Notify via SSH**.\
   ![SSH Notification Setup](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2Fqgghid9LrrcSCDesEz9s%2Fimage.png?alt=media\&token=e4a468fa-4a14-4cfc-aa16-a0fbe3f517c6)
4. In the **Notification Trigger** section:
   * Select **Automatic** to send a notification every time the alert rule is triggered.
   * Select **Manual** to manually send the notification from the [Generated Incidents](#manage-generated-incidents).
5. Enter a **Server** address and a **Port** number.
6. Enter a **Username** for the user in the destination server.
7. Enter a **Command** you want to execute when the alert rule is fired. Make sure that the command is a valid bash command and is executable.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>You can use the Jinja commands <code>{{attack_id}}</code>, <code>{{attack_tag}}</code>, <code>{{attack_category}}</code>, and <code>{{log_source}}</code> in the <strong>Message</strong> field. You can also use the metadata fields associated with the alert as Jinja commands in these Jinja supported fields. If the metadata fields associated with the alert are <em>threatactor</em>, <em>Associated_Malware</em>, and <em>System</em>, then you can use them as Jinja commands as <code>{{threatactor}}</code>, <code>{{Associated_Malware}}</code>, and <code>{{System}}</code>.</p></div>
8. Choose the required mode of **Authentication**: Password or SSH Certificate.

   1. If you choose **Password**, enter a passkey in the **Password** tab.
   2. If you choose **SSH Certificate**, select the **Certificate type**: *System Certificate* or *User Certificate*. The **SSH Certificate** key is automatically generated. You must add the key to the authorized keys at \~/.ssh/authorized\_keys in your system.
      * If you choose *System Certificate*, LPSM uses system-specific certificate for authentication.
      * If you choose *User Certificate*, LPSM uses individual user-specific certificate for authentication.

   Please note the password or the SSH certificate key, as it is required later for user-validation.
9. Set the **Threshold**.
10. Click **Finish**.

</details>

### Manage Alert Rules

After you create an alert rule and configure notifications, you can take additional actions on the generated alerts.&#x20;

<details>

<summary>Push Alert Rules</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Select the alert rules and click **Push**.\
   ![Push](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F6NCVFTI6Q6WTJ94cUUFr%2Fimage.png?alt=media\&token=25f98e69-ef86-4a25-b215-70afe3caae45)

   The **Push Alert Rules** pop-up menu appears.\
   ![Push Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FmPd0XalXhpIWJEsqLGEQ%2Fimage.png?alt=media\&token=8664dc3a-672e-4c6d-8c57-9ff18121472d)

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>An alert rule cannot be pushed from a Logpoint user to itself.</p></div>
3. Select the **Pool**, **Logpoint**, or **User** where you want to push the selected alert rules.
4. Click **Push**.

</details>

<details>

<summary>Push History</summary>

You can click the **Push History** (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FeVBc1f7FJtzFG3WTDvSX%2Fimage.png?alt=media&#x26;token=b51db369-dff8-4bd7-abcb-c777ef31991d" alt="" data-size="line">) button to check the push history.\
![Push History](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FpC5f42rVxLi7m8cjpsD7%2Fimage.png?alt=media\&token=b5509c46-4d06-4c03-8e1c-7547143eebde)

The **Push History** page lists the **Push Summary**, **Status**, **Date**, and **Actions** of all push attempts.

Click the **Retry** (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FONcPLmTxlNDruIqDTRgF%2Fimage.png?alt=media&#x26;token=c0f8a685-a2ad-46f1-9e5f-fcda3cb3f6cb" alt="" data-size="line">) icon from the **Actions** column to retry the failed push attempt.

Click the **Details** (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F9hbiI7mTXXcfV6EDalH0%2Fimage.png?alt=media&#x26;token=771b8a6c-7ef7-46d9-8915-e16c63503716" alt="" data-size="line">) icon from the **Actions** column to open the **Push Detail** page.\
![Push Detail](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FiW4YhzpZxMgvs6B12PT0%2Fimage.png?alt=media\&token=e9d775c4-0b12-46c1-982f-404385920e06)

{% hint style="info" %}
For failed push attempts:

* Click the **Retry** (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FL3gSDshqZ6frkHwqdy5x%2Fimage.png?alt=media&#x26;token=c33a9810-988c-4bd6-a198-ef23929f4628" alt="" data-size="line">) icon from the **Actions** column to retry individual failed push attempts.
* Click the **Details** (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FeGaEt3cHHaDNwlJbsGPW%2Fimage.png?alt=media&#x26;token=5ac900c3-5b6d-41d3-8557-bd744bb884b2" alt="" data-size="line">) icon from the **Actions** column to view the error details about failed push attempts.
  {% endhint %}

</details>

<details>

<summary>Export Alert Rules</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Select the alert rules and click **Export**.\
   ![Export](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FCe3w7hi3QvVE1Gsg6fg4%2Fimage.png?alt=media\&token=ddfd5a5b-8ec9-4eda-b6a4-1acd21140769)
3. Select the export format for the alert rules.\
   ![Export Format](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FkCWqH90COATyh18kkwWm%2Fimage.png?alt=media\&token=5e58e6ee-83ed-4729-8500-b5694eda0db2)

{% hint style="info" %}
After downloading the **.pak** files, you can upload them to any other Fabric-enabled Logpoint from the [Analytics Packages](https://docs.logpoint.com/director/lpsm/search-and-analytics/analytics-packages) section.
{% endhint %}

</details>

<details>

<summary>Edit an Alert Rule</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Name** of the alert rule.\
   ![Editing selected Alert Rule](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F8t5HipVjW5mckzBHlj6L%2Fimage.png?alt=media\&token=688b180c-d379-45a4-ac17-0c9d359eac60)
3. Update the information.
4. Click **Submit**.

</details>

<details>

<summary>Edit Notification Configuration for Multiple Alerts</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Select the alert rules for which you want to setup notifications.
3. Click the **More** drop-down.\
   ![Setup Alert Notifications of Selected Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FsvcdkTXGgRQdNYRNzmAn%2Fimage.png?alt=media\&token=ce167649-342c-4bde-ba61-823a58e57ccf)
4. Select **Setup Notifications of Selected Alert Rules**.
5. Configure the notifications and click **Save**.

{% hint style="info" %}
Enable **Overwrite existing notifications** to update the notifications of the alert rules that do not have the notifications configured. By default, LPSM only updates the alert rules that do not already have the notifications configured.
{% endhint %}

</details>

<details>

<summary>Activate Alert Rules</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Activate alert rule** (![activate](https://docs.logpoint.com/docs/lpsm-search-and-analytics/en/latest/_images/activatear.png)) icon from the *Actions* column for the alert rule.
   * To activate multiple Alert Rules, select the concerned rules. Click the **More** drop-down and select **Activate Selected Alert Rules**.\
     ![Activate Selected Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FUI08gZNvActPaOWjh82u%2Fimage.png?alt=media\&token=a2e6da20-fa9e-4254-a0fb-c4d9071471eb)
   * To activate all the Alert Rules, click the **More** drop-down and select **Activate All Alert Rules**.\
     ![Activate All Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FWXYVVENl3suYkqEndlNF%2Fimage.png?alt=media\&token=bffa0ab3-052b-432f-908c-0bb2f75a3525)

{% hint style="info" %}
You can **De-activate** the alert rules using the same method.
{% endhint %}

</details>

<details>

<summary>Clone Alert Rules</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Clone** (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FZtictimcfihQQyJ6TeKe%2Fimage.png?alt=media&#x26;token=92ebca4f-5553-41c0-98b0-42ea066b40b4" alt="" data-size="line">) icon from the **Actions** column for the alert rule.\
   ![](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FEMQubavAi4RtdsbbTahY%2Fimage.png?alt=media\&token=b2097fb4-de04-40d8-94c8-aaa76ebb9d46)

   Clone Alert Rules
3. Select the **Logpoint user** from the drop-down. The **Pool** and the **Machine** cannot be changed.
4. Enter a new **Name** for the cloned alert rule.
5. Check the **Replace Existing?** checkbox to replace an existing alert rule with the same name.
6. Click **Clone**.

</details>

<details>

<summary>Delete Alert Rules</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Click the **Delete** (![delete](https://docs.logpoint.com/docs/lpsm-search-and-analytics/en/latest/_images/delete_icon.png)) icon under the *Actions* column for the concerned alert rule.
   * To delete multiple alert rules, select the concerned rules. Click the **More** drop-down and choose **Delete Selected Alert Rules**.\
     ![Delete Selected Alert Rule](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FdRODdT5Hjf1YiTVkveRr%2Fimage.png?alt=media\&token=8acbdeb7-09e7-4819-b079-b125605108ff)
   * To delete all the alert rules, click the **More** drop-down and choose **Delete All Alert Rules**.\
     ![Delete All Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FCZFIuXmdZ56hPhJVqSIA%2Fimage.png?alt=media\&token=43f5870a-516b-4670-8f9a-07bf282a6718)
3. Click **Yes** on the delete confirmation dialog box.

</details>

### Share Alert Rules with Users

After you create an alert rule, you can share it with other users by assigning permissions through user groups.

<details>

<summary>Share Alert Rules with Users</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Select the alert rule you want to share and click the **Share to other users** (![share](https://docs.logpoint.com/docs/lpsm-search-and-analytics/en/latest/_images/sharear.png)) icon.
   1. To share multiple alert rules, select the rules. Click the **More** drop-down and select **Share Selected Alert Rules With Users**.\
      ![Share Selected Alert Rules With Users](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FOBFFKg3uoiMiQV4XEPQ6%2Fimage.png?alt=media\&token=63f16769-a9d9-402d-8fa8-c1a80124ca2c)

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Make sure the alert rules are compatible with each other. Use the version compatibility table in the <a href="#alerts">Alert Rules</a> to check for compatibility.</p></div>
3. Select a **User Group**. All the users in the user group are listed in the drop-down.
4. Select the **Read**, **Edit**, or **Full** permissions for the users.\
   ![Role-based Access Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FjMwS4dGgqMqGyjjEsaIB%2Fimage.png?alt=media\&token=3f1e797c-cdfc-4bbf-8cba-45dd6808f38b)
5. Click **Submit**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>You can unshare the alert rules with the users using the same method.</p></div>

</details>

<details>

<summary>Use Shared Alert Rules</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Select **Shared Rules** from the drop-down.
3. Click the **More** icon from the **Actions** column.\
   ![Shared Alert Rules](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2Few4nwQhPYiAXGCf29S0x%2Fimage.png?alt=media\&token=ed3154c2-bc7f-4317-a8d4-ca53ef61c49a)
4. Click the **Use Alert** icon from the **Actions** column.\
   ![Using a Shared Alert Rule](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FNZbLfHrVnwiLwdd3uFfF%2Fimage.png?alt=media\&token=4647e83c-33e0-4a0c-907b-823f5f66c644)

{% hint style="info" %}

* If a user does not have access to a repo used in the shared alert rule, the incident is triggered from other selected repos.
* If only one repo is selected in the shared alert rule, and the user does not have access to the repo, the incident is not triggered.
* After using the alert rules, you can **Activate** or **Deactivate** them from the **Actions** column.
  {% endhint %}

</details>

<details>

<summary>Clone Shared Alert Rules</summary>

1. Go to `Settings >> Logpoint Configuration >> Alert Rules`.
2. Select **Shared Rules** from the drop-down.
3. Click the **Clone** icon from the **Actions** column.\
   ![Cloning a Shared Alert Rule](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FCaWfDLQ4eS9I6zaOeSz1%2Fimage.png?alt=media\&token=6c44fd1f-130a-4794-bf28-121ecd18365e)
4. Enter a **Name** for the cloned rule.
5. Select the **Replace Existing?** checkbox to replace an existing rule with the same name.
6. Click **Clone**.

</details>

### Categories of Alert Rules

There are four categories of alert rules: **My Rules**, **Shared Rules**, **Used Rules**, and **Vendor Rules**. They can be accessed from the drop-down at the top-left corner of the panel.

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FNHcfs0W0qFUqgL00Q5EH%2Fimage.png?alt=media&#x26;token=f9abcfcc-e32d-4f82-b8d8-f4911047d5ea" alt="" width="563"><figcaption><p>Categories of Alert Rules</p></figcaption></figure></div>

**My Rules**

Lists all the alert rules created by the LPSM user or the Fabric-enabled Logpoint user.

{% hint style="info" %}
You can **Setup Notifications**, **De-activate/ Activate**, **Share**, **Clone**, or **Delete** alert rules under the *Action* column.
{% endhint %}

**Shared Rules**

Lists all the shared alert rules.

**Used Rules**

Lists all the used alert rules.

**Vendor Rules**

Lists all the alert rules provided in your application packages.

{% hint style="info" %}
You can click the `Clone` (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2Fxp4lpEBgdiy4Z6I7Kdan%2Fimage.png?alt=media&#x26;token=4cd2455b-e9dc-4de0-869d-10178e4f7893" alt="" data-size="line">) icon under the *Actions* column, to use the shared and vendor alert rules. Enter a name for the clone and hit enter. The alert rule is activated, and the clone appears under the **My Rules** page.
{% endhint %}

## Incidents

**Incidents** are used to identify, analyze, correct, and prevent information hazards in the future. Logpoint lets you find events such as a system crash, power down, cables unplugged, high disk usage, high CPU usage, and forensics by creating incidents for each of them. Incidents can be created from one of three incident sources; **Alert Rules**, **Search** or **UEBA**.

You can subscribe to incident sources of the connected Fabric-enabled instances from `Investigation >> Incidents` the navigation bar. Once the incidents of the subscribed sources are created, you can resolve, re-open, close, and comment on the incidents. The incidents are updated automatically in real time.<br>

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FlJyHesSetFIPikI35iW6%2Fimage.png?alt=media&#x26;token=0c9dcc7d-cf11-4efc-b306-cbc24f51157b" alt="" width="563"><figcaption><p>Incidents</p></figcaption></figure></div>

### Subscribe or Unsubscribe to Incidents

<details>

<summary>Subscribe to Incident Sources</summary>

To view incidents for other Fabric-enabled Logpoints, you need to subscribe to the incident sources.

1. Go to `Incidents` from the navigation bar.
2. Click **SUBSCRIPTIONS**.
3. At the top-right, click **Subscribe**.\
   ![Subscribe](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FzdyHn86K9H9ZCp7Smfdx%2Fimage.png?alt=media\&token=74098820-a7e2-439a-857a-7b54119fc7e1)
4. Select the required incident source.\
   ![Selected Incident Sources](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F9okUWcVlCmkr2s14FfC1%2Fimage.png?alt=media\&token=12489390-b554-42a8-95bd-00f6171a0196)
5. Click **Done**.

   After successful selection, incident sources are populated under **SUBSCRIPTIONS**.\
   ![Subscribed Incident Sources](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FiePa1tQQysXRZQlslxdw%2Fimage.png?alt=media\&token=1b42749f-ac86-4db2-acdc-3aabc6485c52)

{% hint style="info" %}

* If a pool is selected while subscribing to incidents, the new sources added in the Fabric-enabled Logpoints of that pool are subscribed automatically.

* If a Fabric-enabled Logpoint is down or unreachable, its corresponding subscribed incident sources are dimmed.\
  ![Dimmed Incident Sources](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FfE0fhfLPZ5LJwxiGoZU3%2Fimage.png?alt=media\&token=13a249ca-96ed-4cf2-be04-df3e6a4d69a2)

  \
  ![Dimmed Incident Sources](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FZOac4Ug3WSnoJKFX20p1%2Fimage.png?alt=media\&token=1668cf70-0cbe-40a0-9848-1c87e150e6ac)

* When a Fabric-enabled Logpoint is down, its corresponding incident sources cannot be selected or deselected individually. When a pool is selected or deselected, all the subscribed reports are selected or deselected irrespective of any Fabric-enabled Logpoint being down or unreachable.
  {% endhint %}

</details>

<details>

<summary>Unsubscribe to Incident Sources</summary>

1. Go to `Incident` from the navigation menu.
2. Click **SUBSCRIPTIONS**.
3. Click **Unsubscribe** for the incident source.\
   ![Unsubscribe](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FzgyNFOzAuyRTFJTUS9ii%2Fimage.png?alt=media\&token=778d05f5-5be5-40f2-9881-13cd3fa51e99)

To unsubscribe incident sources in bulk:

1. Go to **Subscribe** button on the top right.
2. Deselect the incident sources to unsubscribe.

</details>

### Manage Generated Incidents

When a subscribed alert rule is triggered, an incident is generated and listed in **Incidents** section.<br>

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FnH0u7t4Rwurs4A4BLrfC%2Fimage.png?alt=media&#x26;token=a57a7f43-a279-478d-ab81-9b414b8b0094" alt="" width="563"><figcaption><p>Generated Incidents</p></figcaption></figure></div>

In the Incident feed, the list of all the incidents is displayed along with their corresponding status. You can perform actions such as: **Resolve**, **Re-open**, **Close**, **Re-assign**, and **Comment** on any incident. Additionally, you can send incident notifications for investigation if you have configured the **Manual** notification trigger for the corresponding alert rules.

<details>

<summary>Resolve Incidents</summary>

Once the appropriate action is taken on a particular incident, you can **Resolve** that incident.

1. Go to `Incident >> Incidents`.
2. Click the **Resolve** button of the incident.\
   ![Resolving an Incident](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FelhWE4fArRH2OtCoGhLU%2Fimage.png?alt=media\&token=106e89f2-049a-401d-8e73-32f8419a7c8e)

</details>

<details>

<summary>Close Incidents</summary>

After an incident is resolved, you can close the incident. Once an incident is closed, it is not shown in the incident feed.

1. Go to `Incident >> Incidents`.
2. Click the **Close** button of the incident.\
   ![](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FDZUPc7TgGTM2zyC4FSzT%2Fimage.png?alt=media\&token=73ff5a57-d8a2-41f0-ad63-0fb29bc36b64)

   Closing an Incident

</details>

<details>

<summary>Re-open Incidents</summary>

1. Go to `Incident >> Incidents`.
2. Click the **Re-open** button of the incident.\
   ![Re-opening an Incident](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F0GZPMOhdGOnUsNktUnYj%2Fimage.png?alt=media\&token=8b8711a8-0a9b-4e8e-bb96-2d529f92d257)

</details>

<details>

<summary>Comment on an Incident</summary>

You can post comments about the incidents seen in the incident feed. You can track the actions taken over an incident via the comments.

1. Go to `Incident >> Incidents`.
2. Click the **Comment** button of the incident.\
   ![Comment](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FeHxaOXB0uQV0lsm5SkB2%2Fimage.png?alt=media\&token=187b39c3-6b5d-4cdc-9586-f5efc29bbf26)

</details>

<details>

<summary>View Incident Data</summary>

You can view the details of an incident in a format specified while creating its alert rule.

1. Go to `Incident >> Incidents`.
2. Click the **Incident Data** button of the incident.\
   ![Incident Data](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FXPU4wSbgC93MNzFy5xST%2Fimage.png?alt=media\&token=b1e8ef5c-dfc5-424f-adee-ab57b324a5d2)

You can monitor each incident’s status using the **Incident ID**, which is a unique ID of an incident. You can also view the corresponding alert rule’s **AlertRule ID**.

{% hint style="info" %}
An **AlertRule ID** is only available in incidents generated from an alert.
{% endhint %}

\
![Incident Data View](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FhQi0w9YmkDFbcP5Z5WSs%2Fimage.png?alt=media\&token=c0e6e5de-0819-4fcc-aa43-b4ba72ea80d9)

</details>

<details>

<summary>View Incident Logs</summary>

You can view the logs that triggered an incident from the **View Data** option, which directs you to the **Search** page to view the logs.

1. Go to `Incident >> Incidents`.
2. Click the **View Data** button of the incident.\
   ![View Data](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FYg4BNTaGHlfv7Ogn1Doz%2Fimage.png?alt=media\&token=5879a3cd-2f42-4451-9eac-c52657cfa48d)\
   ![Incident Data Logs](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FySyuCt71lgMgsZvLCIze%2Fimage.png?alt=media\&token=7c03fa65-cdc9-49ce-989d-8d896aeee994)

{% hint style="info" %}
You can view the incident information like **Alert Name**, **Incident ID**, and **Incident Timestamp** from the **Incident Info** (<img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2Fdfxz5GGlmFJCftG7Y62x%2Fimage.png?alt=media&#x26;token=07ff9f04-1295-4a2a-8fda-9eb4de85c34d" alt="" data-size="line">) icon on the redirected tab.\
![Alert Incident Data](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FnLr4iYCg1gkGYUOTWy6l%2Fimage.png?alt=media\&token=04aa5cc3-5b3e-45d4-a19a-1a8d7e34ad70)
{% endhint %}

</details>

<details>

<summary>Re-assign Incidents</summary>

You can reassign an incident to another user only if the user assigned to its corresponding alert rule is deleted from the Fabric-enabled Logpoint. You can reassign the incident to the owner of the alert rule or a user with the **Manageable by** ownership.

1. Go to `Incident >> Incidents`.
2. Click the **Assign to** button of the incident.\
   ![Assign to](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FcPG9renkCwmD7OnIiPgd%2Fimage.png?alt=media\&token=d47656db-9fe1-4041-9897-2831ec7bde75)
3. Select the **User**.\
   ![Assign to User](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FLL3rdAOGT3C4abVOGiwC%2Fimage.png?alt=media\&token=fc8844f5-3499-430c-972b-49140a4b2f9a)\
   ![Incident Reassigned](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FMR6gsG82FP5MCu7dIexG%2Fimage.png?alt=media\&token=6d2b0ed0-375e-49a8-b8c7-2585c31d8467)

{% hint style="info" %}
You **cannot** perform other incident actions without reassigning the incident to another user.
{% endhint %}

</details>

<details>

<summary>Send Incidents for Investigation</summary>

You can use the **Send For Investigation** and **Re-Send For Investigation** options to manually send incident notifications for further investigation.

1. Go to `Incident >> Incidents`.
2. Click the **Send for Investigation** button.\
   ![Send for Investigation](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FDoEQXP7BRrpBTJunFW3g%2Fimage.png?alt=media\&token=d14b1813-802a-44a4-aa43-5985c21f1f5e)

{% hint style="info" %}

* The **Send For Investigation** and **Re-Send For Investigation** options only appear if one of the notifications has been set to trigger manually in the corresponding alert rule.
* When you click **Send For Investigation**, only the notifications configured with the **Manual** trigger for the corresponding alert rule are sent.
* You can send incidents generated from Search, Dashboard, Search template, and UEBA for investigation manually. The **Send For Investigation** and **Re-Send For Investigation** options are not available for these incidents. You can use the **Send Selected For Investigation** option under the **More** drop-down to send the incident(s) for investigation.
  {% endhint %}

</details>

<details>

<summary>Other Incident Actions</summary>

The **More** drop-down in the **Incident** page lists additional actions. You can select the incidents and choose to **Resolve Selected**, **Resolve All**, **Close Selected**, **Close All Resolved**, and **Send Selected For Investigation**.\
![More](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FNZhNnfSygfoZeiqJmb2O%2Fimage.png?alt=media\&token=a5886d43-d138-4e78-99dc-bc08141a7303)

* The **Resolve Selected** and **Resolve All** options let you resolve multiple incidents at once.
* The **Close Selected** and **Close All Resolved** options let you close multiple incidents at once.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The incidents <strong>cannot</strong> be closed without being resolved first.</p></div>
* The **Reassign Selected** and **Reassign All Selected** options let you reassign multiple incidents at once. Reassigning opens a window prompting you to select a user to reassign the incidents to.
* The **Send Selected For Investigation** option lets you send the notifications configured for the selected incidents. You can either select a single incident or multiple incidents and send them in an email using the **Send Incident(s) for Investigation** dialog box.\
  ![Send Incident(s) for Investigation dialog box](https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2FT4Qj9nLzZtX9QAgUCuaX%2Fimage.png?alt=media\&token=da457a59-94cf-4d76-b26d-5a3834793349)
  1. Enter valid email addresses under **Emails**.
  2. Enter a **Subject**.
  3. Select **Disable Search Link** to remove the search link from the email. The search link redirects you to the search page of the Logpoint instance where the email notification is configured.
  4. Select **Enable Logo** if you want to include the Logpoint logo in the email notification.
  5. **Browse** for the image in JPG/JPEG format if you want to provide a custom logo. The maximum dimension for the custom logo is 600\*400.
  6. Click **Submit**.

{% hint style="info" %}

* You **cannot** close an incident without resolving it first.
* Any pre-configured settings for email notification are replaced with the configurations set in the **Send Incident(s) for Investigation** dialog box for the particular instance.
* Only the incidents corresponding to the alert rules configured for manual trigger in email notification are sent in email.
* To perform incident actions in bulk, the incidents of the Fabric-enabled Logpoint instances must be compatible with each other. The version compatibility of the incident actions are in the following table.&#x20;
  {% endhint %}

| **Fabric-enabled Logpoint** | **Compatible Fabric-enabled Logpoint Versions** |
| --------------------------- | ----------------------------------------------- |
| 6.9.x                       | 6.9.x                                           |
| 6.10.x                      | 6.10.x                                          |
| 6.11.x                      | 6.11.x to 6.12.x                                |
| 6.12.x                      | 6.11.x to 6.12.x                                |
| 7.0.x                       | 6.11.x to 7.0.x                                 |

</details>

<details>

<summary>Filter an Incident</summary>

To simplify or narrow down the search for a particular incident, you can use filters such as Logpoint **Pool**, **Machine**, **Name Or ID**, **Time Range**, **Risk**, **Attack Category**, **Attack Tag**, **Log Sources**, **Type**, and **Status**.

The filters are described below:

* **Pool**: Using this filter, incidents can be filtered by the selected Logpoint Pool.
* **Machine**: Using this filter, incidents can be filtered by the selected machine belonging to the selected Logpoint Pool.
* **Name Or ID**: Using this filter, a particular incident can be searched by its name or its **Incident ID**. You can also search for all the incidents associated with an alert using the **AlertRule ID**. You can obtain the **Incident ID** and **AlertRule ID** by clicking the **Incident Data** option on the **Incident** page.
* **Time Range**: Using this filter, the incidents generated at a particular time can be viewed.
* **Risk**: Using this filter, the incidents can be viewed according to a particular severity level (critical, high, medium, or low).
* **Attack Category**: Using this filter, the incidents can be viewed according to the attack categories associated. You can select multiple attack categories from the drop-down.
* **Attack Tag**: Using this filter, the incidents can be viewed according to the attack tags associated. You can select multiple attack tags from the drop-down.
* **Log Sources**: Using this filter, the incidents can be viewed according to the log sources associated. You can select multiple log sources from the drop-down.
* **Type**: Using this filter, the incidents can be viewed by the source (alert, search, or UEBA) where they are generated.
* **Status**: Using this filter, the incidents can be viewed according to their status (resolved, unresolved, or closed).

<div align="left"><figure><img src="https://3198401301-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhzE0kPDYI002AO7fHbFv%2Fuploads%2F9pVzEt87UfmTGnqanMel%2Fimage.png?alt=media&#x26;token=ca658368-4e53-4cb4-bb73-713732c3daf4" alt=""><figcaption><p>Filter</p></figcaption></figure></div>

</details>
