The workspace

The parts of the console that appear on every screen, and the controls that behave the same wherever you meet them.

The sidebar follows the order of an analyst's work, in five groups.

Group	Screens
Overview	Command Center
Detect	Alerts, Alert Pipeline, Triage Queue, Incidents
Investigate	Endpoints, Deploy Agent, File Integrity, Threat Intelligence, ATT&CK Coverage, AI Analysis
Respond	Response Center, Playbooks, Response Scripts, Script Deployment
Administration	Accounts, Settings

The sidebar shows only what your role permits. Playbooks, Response Scripts, Script Deployment and Accounts are visible to administrators only. See Users and roles.

The top bar#

Control	What it does
Search	Finds alerts, matches endpoints by name, address, operating system or group, and jumps to any screen by name. Press `/` to focus it from anywhere.
Service indicators	Detection Engine, Threat Intelligence, Correlation Engine and AI Analyst. Green means the service is answering.
Notifications	The bell, with a count of unread items. See Notifications below.
Theme	Switches between light and dark. The choice is remembered.
Profile	Your name and role, change password, and sign out.

Notifications#

The bell collects what needs your attention, without leaving the screen you are on. Three things raise a notification:

Category	Raised when
Security alert	A new alert of High or Critical severity is stored.
Incident	The correlation engine opens a new incident.
Response	A response action finishes: dispatched, failed, refused or reverted.

Selecting a notification opens the alert, incident or action behind it. Mark all read clears the count. Notifications live in the console; Alertio does not send email.

Controls you will meet everywhere#

Time range#

Most screens are limited to a period: 1h, 24h, 7d, 30d, All, or Custom with a start and end. Changing the range asks the server again; it does not just hide rows already loaded. Every tile and chart on a screen follows the same range, so the figures always agree with one another.

Severity#

Four levels, each with a colour, a shape and a word, so the level can be read without relying on colour: Critical, High, Medium and Low.

Lists and detail panels#

Data is shown in dense tables. Selecting a row opens a detail panel on the right instead of a new page, so you keep your place. Previous and Next move through the rows without closing the panel.

Filters#

Every filter you apply appears as a chip under the filter bar. Remove a chip to lift that one filter, or use Clear all. Less common filters are behind Advanced.

Paging and refresh#

Long lists are paged on the server, so they stay fast however much data there is. Screens with live data have a Refresh control, which is disabled while a request is running.

Information tips#

The ⓘ beside a figure says exactly what it counts and over what period.

Signing in#

Sign in with your username or your work email. A session lasts up to 12 hours; Keep me signed in extends it to 30 days. Passwords are reset by an administrator from Accounts; there is no reset by email.

Something missing or wrong on this page? Tell us and we will fix it.