Documentation Center
AlienVault® USM Central™

Alarm Labels

Labels can be applied to alarms in USM Central to streamline the alarm management process by enabling you to create and distribute labels across all other connected deployments from your instance of USM Central.

Label Management with Connected Deployments

Because of the way that USM Central handles its own labels and the inherited labels of the connected deployments, there are a few things that are important to understand and consider

  • USM Central automatically collects and displays all labels from connected deployments. You can only edit these inherited labels and apply them to alarms in their individual deployment of USM Anywhere.
  • You can apply the labels you've created in USM Central to alarms in both USM Anywhere and USM Central. You can only edit these labels in USM Central, and not in USM Anywhere.
  • In cases where an identically-named label exists in both USM Anywhere and USM Central, USM Central will assume control of the label's management.
  • Similarly, if you would like to have USM Central assume ownership of an active label in USM Anywhere, you can recreate the label in USM Central using the same naming conventions. This will make the distribution and editing of the labels exclusive to USM Central.
Apply Labels to Alarms in Anywhere Edit/Delete Labels in Anywhere Apply Labels to Alarms in Central Edit/Delete Labels in Central
Label Created in Anywhere Yes Yes No No
Label Created in Central Yes No Yes Yes

Best Practices for Label Management

Because of the way that labels are managed across USM Central and the connected deployments, it is important to have a manageable plan for label implementation. For example, given that labels created in USM Central can be applied in all connected deployments, their application will be more broadly used than deployment-specific labels. It would be useful to have an easily identifiable naming convention for the USM Central labels that is applicable to all deployments.

It is important to keep in mind that labels created in USM Central that share a name with a label in a connected deployment will take control of the inherited label as well, so if a label needs to be able to be edited in USM Anywhere, you'll want to avoid using the same name for a label in USM Central. Alternately, if you have similar types of labels across your USM Anywhere deployments that you would prefer to manage at a more “global” level in USM Central, it would be best to make them all share the same name before creating a label of that name in USM Central; that way they can all be rolled up into USM Central at once.

Alarm Label Usage

USM Central allows you to create, edit, and delete your own labels. You can apply a label to one or more alarms. You can also apply multiple labels to the same alarm.

To label alarms

  1. Navigate to ALARMS.
  2. Search for the alarm or alarms you want to apply a label, and select them.
  3. Click Apply Labels.
  4. Select the label(s) you want to apply.
  5. Click Apply.

Note: You can also label an alarm from the Labels column of the alarm list view by clicking the Label icon ().

To create a new label

  1. Navigate to ALARMS.
  2. Click Apply Labels.
  3. Click Create New Label.
  4. Type a name for the label.
  5. Select a color for identifying the label.
  6. Click Save.

To edit a label

  1. Navigate to ALARMS.
  2. Click Apply Labels.
  3. Click Manage Labels.
  4. Click the Edit icon () of the label you want to modify.
  5. Modify the name of the label or its color.
  6. Click the Update icon ().

To delete a label

  1. Navigate to ALARMS.
  2. Click Apply Labels.
  3. Click Manage Labels.
  4. Click the Delete icon () of the label you want to delete.
  5. Click Accept to confirm the deletion.