AlienVault® USM Central™

Alarms Page Overview

The alarms page allows you to filter alarms, view alarms from specific deployments, create preset views, and export alarm information.

  • Search & Filters Sidebar — The left side of the alarms page features the Search & Filters sidebar. You can use this to search for specific items and to create filter views for future reuse. Filter views can be saved in the Saved Views area at the top of the page. For more information, see Search and Filter Alarms.
  • Alarms Graph — The graph provides an overview of alarm activity over the time range specified in the Created during field at the top of the Alarms page. Activity can be displayed either by alarm intent type or by frequency over time. You can mouse over each of the circles in the Alarms By Intent view to get the actual number of different types of intent, or you can click the blue circles to have USM Central display only the alarms corresponding to that circle in the list view below.
  • Click this button to change the graph to a Count/Time, MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) or Alarm Strategies by Intent view.

  • List View — Below the graph, all of the filtered alarms are shown. If no filters have been applied, all of the recent alarms will be shown. You can click the icon to open the Column Configurations dialog box to customize the content displayed in the columns. For more information, see Alarms List View.
  • Saved Views — Saved filter views can be recalled at any time for quick access to useful information. You can also click the icon to open the Export as Report option where you can create a report based on any of these saved filter views. Reports can either be exported as CSV or HTML formats. For more information, see Create Alarms Report.

Note: Click the icon to bookmark an item for quick access. Clicking the icon on the secondary menu shows the bookmarked items and provides links to them.

Auto Refresh Alarms

By default, the alarms on the main page only refresh when the page is loaded. You can choose to have the alarms page automatically refresh the alarms at a designated interval.

To enable the auto refresh option

  1. Click the icon, then click Profile.
  2. In the Alarms Auto Refresh field, click the drop-down box and select Every 15 Minutes, Every 30 Minutes, Every Hour, or Every Two Hours. Select Disabled if you don't want the alarms to automatically refresh.
  3. Click Save.