Overview
UTMStack’s alert management system provides comprehensive capabilities for detecting, triaging, and responding to security events. The alert system helps SOC analysts identify threats quickly and take appropriate action. Alerts are managed through/iframe (alert management interface) and /alerting-rules (rule configuration).
Real-time Alerts
Receive instant notifications when security rules are triggered
Alert Rules
Configure custom detection rules at
/alerting-rulesAlert Triage
Prioritize and classify alerts by severity and category
Alert Workflows
Automate alert enrichment and response actions
Alert Components
Alert Attributes
Each alert in UTMStack contains:- Alert ID - Unique identifier for tracking and reference
- Severity - Critical, High, Medium, Low, Informational
- Status - New, Acknowledged, In Progress, Resolved, False Positive
- Category - Malware, Intrusion, Data Exfiltration, Policy Violation, etc.
- Source - Originating data source or integration
- Timestamp - When the alert was triggered
- Description - Detailed alert information and context
- Related Events - Associated log events and indicators
- Assigned To - User responsible for alert investigation
Alert Severities
Critical
Immediate threat requiring urgent response (e.g., active breach)
High
Serious security event requiring prompt investigation
Medium
Notable security event requiring timely review
Low
Minor security event or policy violation
Informational
Contextual information or baseline activity
Alert Management Workflow
For SOC Analysts
Gather Context
Review alert details, related events, and threat intelligence from
/threat-intelligenceTake Action
- If True Positive: Create incident at
/incidentor trigger SOAR playbook at/soar - If False Positive: Update alerting rule at
/alerting-rulesto reduce noise - If Benign Positive: Document and resolve with notes
Alerting Rules
Rule Types
UTMStack supports multiple types of detection rules accessible at/alerting-rules:
Signature-based Rules
Match known attack patterns and indicators of compromise (IOCs)
Anomaly Detection
Detect statistical deviations from baseline behavior
Correlation Rules
Identify patterns across multiple events or data sources
Threshold Rules
Trigger alerts when metrics exceed defined thresholds
Behavioral Rules
Detect suspicious user or entity behavior patterns
Compliance Rules
Monitor compliance violations and policy breaches
Creating Alert Rules
Define Trigger Conditions
Specify the conditions that will trigger the alert (query, threshold, correlation)
Alert Triage and Prioritization
Triage Criteria
Effective alert triage considers multiple factors:- Severity Level - Critical and High alerts take priority
- Asset Criticality - Alerts affecting critical assets (from
/data-sources) rank higher - Threat Context - Alerts with threat intelligence matches require attention
- Alert Frequency - Recurring alerts may indicate persistent threat
- Business Impact - Potential impact on business operations
- Compliance Requirements - Regulatory obligations may mandate response times
Prioritization Matrix
| Alert Severity | Critical Asset | Non-Critical Asset |
|---|---|---|
| Critical | P1 (Immediate) | P2 (Urgent) |
| High | P2 (Urgent) | P3 (High) |
| Medium | P3 (High) | P4 (Medium) |
| Low | P4 (Medium) | P5 (Low) |
Alert Enrichment
Automatic Enrichment
UTMStack automatically enriches alerts with:Asset Information
Asset details from
/data-sources including owner, location, and criticalityThreat Intelligence
IOC matches and reputation data from
/threat-intelligenceUser Context
User details from Active Directory integration at
/active-directoryHistorical Data
Related historical alerts and incidents
Geolocation
Geographic information for IP addresses
Related Events
Correlated log events from
/discoverManual Enrichment
Analysts can add enrichment through:- Investigation notes and analyst comments
- External threat intelligence lookups
- Contact with asset owners for context
- Links to related incidents and tickets
Alert Response Actions
Manual Actions
Create Incident
Escalate alert to formal incident at
/incidentBlock IOC
Add indicators to blocklists via integrations
Isolate Asset
Quarantine affected systems through network controls
Reset Credentials
Force password reset via
/active-directoryAutomated Actions (SOAR)
Configure automated responses through/soar:
- Automatic ticket creation in external systems
- IOC enrichment via threat intelligence feeds
- Email notifications to stakeholders
- Webhook triggers to external security tools
- Asset isolation through firewall rules
- User account suspension for compromised credentials
Alert Metrics and Reporting
Key Performance Indicators
Track alert effectiveness with these metrics:- Alert Volume - Total alerts per day/week
- Mean Time to Acknowledge (MTTA) - Average time to acknowledge alerts
- Mean Time to Resolve (MTTR) - Average time to resolve alerts
- False Positive Rate - Percentage of alerts marked as false positives
- True Positive Rate - Percentage of alerts representing real threats
- Alert Coverage - Percentage of MITRE ATT&CK techniques covered
- Rule Effectiveness - Alerts triggered per rule and disposition
Alert Reporting
Alert Tuning and Optimization
Reducing False Positives
Strategies for reducing false positives:- Whitelist Known Good - Exclude legitimate business activity
- Adjust Thresholds - Fine-tune numeric thresholds based on baseline
- Add Context Filters - Include additional conditions (time, user, asset)
- Correlation Over Single Events - Require multiple indicators
- Severity Adjustment - Lower severity for noisy but important alerts
Rule Maintenance Workflow
Alert Integration
Data Sources
Alerts can be generated from various sources configured at/integrations:
- Network security devices (firewalls, IDS/IPS)
- Endpoint detection and response (EDR) solutions
- Cloud security platforms (AWS, Azure, GCP)
- Email security gateways
- Web proxies and DNS logs
- Authentication systems and Active Directory
- Application logs and custom integrations
External Systems
Integrate alerts with external platforms:- Ticketing Systems - ServiceNow, Jira, Zendesk
- Communication Platforms - Slack, Microsoft Teams, Email
- Threat Intelligence - MISP, ThreatConnect, feeds at
/threat-intelligence - SOAR Platforms - Trigger playbooks at
/soar
Best Practices
Alert Management
- Acknowledge Promptly - Acknowledge alerts within SLA timeframes
- Document Thoroughly - Add detailed notes during investigation
- Update Status Regularly - Keep alert status current for team visibility
- Communicate Escalations - Notify team when escalating to incidents
- Track Metrics - Monitor MTTA and MTTR for continuous improvement
Rule Development
- Start Conservative - Begin with higher thresholds and refine over time
- Test Before Deploying - Validate rules against historical data
- Version Control - Document rule changes and rationale
- Peer Review - Have rules reviewed by other analysts
- Regular Audits - Quarterly review of all active rules
Related Resources
Alerting Rules
Configure and manage detection rules
Incident Management
Escalate alerts to formal incidents
SOAR Automation
Automate alert response actions
Threat Intelligence
Enrich alerts with threat intel