Alerts and cases

Noticing that something has happened enough times to matter, as opposed to reporting every single event.

Open Alerts in your console.

Why thresholds#

A notification per refused sign-in has no threshold. One refusal is noise: somebody mistyped a password. A weekly summary is too slow: a password-guessing run starts and finishes long before it is sent. An alert rule fires when a count crosses a threshold inside a window, which is the shape an actual attack has.

The rules#

Rule	Fires when	Threshold	Window	Severity
Repeated failed sign-ins	One account failing to sign in repeatedly — a password-guessing run looks exactly like this.	5	10 minutes	Warning
Account locked out	Keycloak's brute-force protection disabled an account. By the time this fires the attempt was sustained enough for Keycloak to act on it.	1	1 hour	Critical
Repeated policy refusals	One account refused or challenged repeatedly by the network policy — either an attacker, or a rule that is too tight for a real person.	5	10 minutes	Warning
Sign-in from a new country	An account signed in from a country it has never used before.	1	1 day	Warning
Sign-in from a new network	An account signed in from a network (ISP) it has never used before, in a country it already uses. Silent on an account's first sign-in, and when the country is new too — the new-country rule already speaks for that.	1	1 day	Warning
Device far below the bar	A device scored far below the policy's target — an unmanaged or unpatched machine reaching a real account.	1	1 hour	Warning
Sign-in at an unusual hour	An account signed in during an hour it does not normally use, judged against that person's own history rather than a fixed working day. Silent until there is enough history to have an opinion.	1	1 day	Warning
Signed in from two countries at once	One account with live sessions in different countries at the same time. Unlike impossible travel this needs no assumption about how fast anyone can move — both sessions are open now.	1	1 hour	Critical

Each rule can be switched on or off, and its threshold and window changed.

The Alerts page: each rule with its threshold, its window in minutes, a switch, and what to do when it trips. — Alert rules. Each has a threshold, a window and an action.

A quiet page describes your rules, not your week

If the Alerts page says nothing is tripping, that is a statement about your rules, not a promise that nothing happened. A threshold set high enough will never fire.

Actions#

A rule can notify, or act. An automatic action runs at most a fixed number of times an hour. After that the rule only notifies.

This matters when you read a quiet-looking hour: the action may have reached its ceiling, not stopped being needed. The action history shows what was taken and what came of it.

Cases#

When a rule trips it opens a case, which is the unit you triage.

A case has
Kind and subject	Which rule tripped, and who it concerns.
Severity	Warning or critical.
Status	Open cases are what needs attention.
Assignee	Whoever has taken it.
Occurrences	How many times it has recurred.
First and last seen

A case that recurs does not open a second case. It raises the occurrence count, so the list stays the length of your actual problems.

Testing a rule#

Use the test action on the Alerts page after changing a threshold. A rule that never fires and a rule that is switched off look identical from the outside.

Watched people#

While someone is on the watchlist, their thresholds are halved.

Getting alerts elsewhere#

Subscribe a webhook to alert.triggered to receive every tripped rule in your own system.

Something missing or wrong on this page? Tell us and we will fix it.