Alerts Report Configuration

This topic describes the metadata that you can select to be included in an Alerts type report (see Report Types).

ObserveIT enables you to create customized reports that provide summary information about alerts on monitored Windows, Mac, or Unix-based endpoints.

For detailed instructions on the steps required to create a report, see Creating a Custom Report.

Following are some examples of reports you might want to create:

  • Alerts that were generated on the detection of user actions to copy files or insert USB storage devices with the intent to exfiltrate data (for details, see Detecting Data Loss in ObserveIT).

  • Alerts based on specific (user-defined) interactions with sensitive application (In-App) elements.

  • Alerts on Windows or Unix machines grouped by risk level that were deleted during the last year. For each alert, you could select to display in the report the alert date, user identity, alert rule name, endpoint name, etc.

  • All critical alerts that occurred during the last month on Windows or Unix machines, grouped by User Identity. For each alert, you could select to display in the report the alert date, rule name, application name, Website name, top level command, endpoint name, etc.

  • All critical alerts on Windows or Unix machines grouped by User Identity that were marked as Ignored during the last week. For each alert, you could select to display in the report the alert date, rule name, endpoint name, etc.

When creating an Alerts type report, you can specify types of columns for:

Type Column Description

Alerts

Alert Date

Date (from local endpoint) the alert was triggered. (selected by default)

Alert Date (server time)

Date (from server) the alert was triggered.

Interacted Application

Name of the application with which the user interacted (as shown in the Windows Task Manager).

Alert Rule Name

Name of the alert rule. (selected by default)

Risk Level

Severity of the alert (Critical, High, Medium, or Low). (selected by default)

Status

Current status of the alert (New, Reviewing, Issue, or Non-Issue).

Marked as Flagged

Alert is flagged for further attention.

Play Video (Alert Point)

Video playback from point of alert.

Alert Detail

Details of alert.

User Text Feedback

Text feedback that the user provided when receiving a warning notification or blocking message action.

Action Type

Action that was taken when the alert was triggered.

Available action types include: No Action, Warning Notification, Blocking Message, Log Off, Close Application, Start Video Recording, Prevent Execution, and Start Standard Recording.

The following operators allow you to select from a list of predefined action types to be included in or excluded from your report:

  • inc. in defined list
  • exc. from defined list

You can select the check boxes of one or more actions that you want to include in your report, or [Select all] to view alerts with all types of actions.

Viewing Status

Status of the alert on the Agent: New, Received, Displayed, Recording, or Expired.

The following operators allow you to select from a list of predefined viewing status(es) to be included in or excluded from your report:

  • inc. in defined list
  • exc. from defined list

You can select the check boxes of one or more statuses or [Select all] to view alerts with all types of statuses.