AlienVault® USM Central™

Alarm Status

USM Central includes a set of statuses, which you can use to classify your alarms, track alarm status, and search alarms using statuses as a filter. Statuses are shared across both USM Central and USM Anywhere, so when an alarm status is updated in either USM Central or USM Anywhere, both environments will reflect the updated status. For more information on how to search alarms, see Search and Filter Alarms.

You can not edit or delete the set of default statuses:

  • Open
  • In Review
  • Closed

USM Central enables you to apply just one status to an alarm. You can not apply multiple statuses to the same alarm.

Note: The alarms having the status as 'Closed' will not be displayed in the Alarm list view.

To apply a status to an alarm from the alarms main page

  1. Go to Alarms.
  2. Search the alarm you want to apply a status. See Search and Filter Alarms for more information.
  3. Select the checkbox to the left of the alarm.
  4. Click Alarm Status and select a status.
  5. Click Apply.

To apply a status to an alarm from the alarms details page

  1. Go to Alarms.
  2. Search the alarm you want to apply a status. See Search and Filter Alarms for more information.
  3. Click the alarm.
  4. Click Alarm Status and select a status.
  5. Click Apply.

To bulk set the alarm status

  1. Go to Alarms.
  2. Select all of the alarms to which you want to apply a status. See Search and Filter Alarms for more information. Select the checkbox to the left of an alarm. You can also select several of them or select all alarms at the same time by selecting the first checkbox in the column.
  3. Click Alarm Status and select a status.
  4. Click Apply.

To search alarms having a status

  1. Go to Alarms.
  2. Click the filter to select the name of the status on the left panel.
  3. The alarm list will display the alarms having the selected status.