Documentation Center
AlienVault® USM Anywhere™

Viewing Alarms with Applied Cisco Umbrella Response Actions

  Role Availability   Read-Only   Analyst   Manager

USM Anywhere uses labels as a mechanism to classify alarmsAlarms provide notification of an event or sequence of events that require attention or investigation.. These labels make it easy to filter items by an applied label so that you can locate them easily and track their status. When the AlienApp for Cisco Umbrella executes a response actionIn USM Anywhere you can execute an action from alarms, events, and vulnerabilities to run a scan, get forensic information, or execute a response for a configured AlienApp. for an alarm, it automatically applies the Cisco Umbrella label to it. You can select this label as a filter so that a page displays data for only the items related to an AlienApp for Cisco Umbrella response action.

To view alarms with applied Cisco Umbrella response actions

  1. Open the Alarms page.
  2. If the Search & Filters panel is not displayed, click the Filter icon () to expand it.

    USM Anywhere includes several filters displayed by default.

  3. Locate the Labels filter and select the Cisco Umbrella label.

    Use the Labels filter to view items with the Cisco Umbrella label

    If the Labels filter is not displayed, click the Configure Filters link at the bottom of the Search & Filters panel to configure filters for the page. (For more information about configuring filters for the page display, see Managing Filters.)

    In the displayed list, you can scroll the list to the right and view the LABELS column.

    Scroll the list to the right to view the Labels column