Core concepts

Alert#

A single detection: a rule matched an event on an endpoint or a sensor. An alert carries the rule that fired, its level, the endpoint, the time, any addresses or files involved, and the original event exactly as it was received. See Alerts.

Severity and risk score#

These are two different things, and Alertio shows both.

Severity says what kind of event this is. The risk score says how much it matters here and now. The score is explained in full in Risk scoring.

Deduplication#

Identical alerts within a five-minute window are combined into one, with an occurrence count. A rule that fires four hundred times becomes one row that says ×400, not four hundred rows.

The gate, the queue and suppression#

The gate is the score an alert needs to reach an analyst on its own. By default it is 50. Alerts that reach it, and alerts admitted for another reason, form the Triage Queue: the analyst's working list. Everything else is suppressed. Suppressed alerts are kept, searchable and auditable; nothing is deleted. See Triage Queue.

Incident#

A group of related alerts that together describe one attack, for example a password spray, then a successful sign-in, then a change to an administrators group. An incident has its own risk score, a title that names what happened and to whom, and a status: New, Acknowledged or Closed. See Incidents.

Kill chain#

Six stages an attack moves through: Reconnaissance, Credential Access, Exploitation, Privilege Escalation, Lateral Movement and Impact. Alertio places each alert on one stage, so an incident shows how far an intrusion progressed. The furthest stage reached is the incident's kill-chain depth.

Correlation pattern#

A rule that recognises an attack across several alerts, such as reconnaissance followed by exploitation, or ten failed sign-ins in five minutes. Alertio ships seven. See Correlation patterns.

Endpoint and agent#

An endpoint is a machine Alertio monitors. The agent is the lightweight program on it that sends events and carries out response actions. See Endpoints and Deploy agents.

Asset criticality#

How important a machine is to your organisation: Low, Medium, High or Critical. It is one of the four factors of every score. You set it in Settings.

Response action and playbook#

A response action is one thing done to an endpoint, such as blocking an address or isolating a host. A playbook is a sequence of actions run together. Both are previewed before they run and recorded after. See Response actions and Playbooks.

Response script#

Your own code that runs on an endpoint as a response action. Written, validated, tested and deployed from the console. See Response scripts.