How does it work?
The Alert Management system categorizes alerts based on severity and resolution status, ensuring security teams can effectively prioritize. The platform allows users to filter alerts using various criteria to streamline the response process.
Available Filters:
Resolution Status:
Pending: Alerts that require review and action.
Resolved: Alerts that have been addressed and no longer pose a threat.
Severity Levels:
Critical: High-risk threats requiring immediate action.
High: Significant security concerns needing prompt attention.
Medium: Moderate risks requiring attention but not urgent.
Low: Low-impact threats that should be monitored.
Security Control:
Reputation Scan: Identifies compromised credentials linked to company domains or users.
Domain Security: Detects potential domain impersonations and DNS threats.
Device Protection: Ensures endpoint security through real-time monitoring and response.
Secure Browsing: Blocks access to malicious websites and prevents unsafe downloads.
Vulnerability Scan: Scans systems and applications for security weaknesses.
Date Range:
Users can select specific time periods to analyze alerts over a given timeframe.
Minimum Affected Users:
Set a threshold for filtering alerts impacting a minimum number of users, prioritizing high-exposure incidents.
Benefits of Alert Management:
Enhanced Threat Visibility: Provides a centralized view of security incidents.
Efficient Incident Response: Filters help prioritize and address the most critical threats first.
Comprehensive Protection: Integrated with other BlackfishID security controls for proactive risk mitigation.
Relation to Other Security Controls:
The Alert Management module works alongside other security features, such as Device Protection and Secure Browsing, ensuring a robust cybersecurity ecosystem that prevents and mitigates threats effectively.