Create Alerts in the Advanced Visualization Tool

Applies To: WatchGuard Advanced Reporting Tool and Data Control

Alerts are tasks that continually monitor active queries to look for and report on specific events or conditions. When the conditions of the alert are met, an alert notification is triggered.

You can create up to 10 custom alerts. When you create a custom alert, you configure the frequency of the alert, the conditions to generate an alert, and the delivery method.

To see current alerts and the alerts history, from the left pane, select Alerts.

Screen shot of WatchGuard EPDR, Advanced Visualization Tool, Alerts dashboard

For more information on the Alerts Dashboard, see Manage Available Alerts

You create alerts on the Data Search page where you create queries.

Screen shot of WatchGuard EPDR, Advanced Visualization Tool data table

For information on data tables, see About Data Tables.

To create an alert, from the Advanced Visualization Tool:

  1. From the left pane, select Data Search.
  2. Select the time period you want to create the alert for.
  3. Select the appropriate data table.
  4. To generate the information table you want, apply filters and data transformations.
  5. To show the exact settings of the data source that generates the data table and the specified time interval, click Toggle Query Editor.
  6. In the toolbar, click New Alert Definition.
  7. Type a Summary to help identify the alert.
    This text displays in the Alerts History. For more information, see Advanced Visualization Tool Window.
  8. Type a full Description for the alert.
    When distributed by email, this text appears in the email body. In the Alerts History, you see this information when you use expand the Summary.
  9. Type or select a Subcategory for the alert.
    By default, alerts are grouped in the My Alerts group.
  10. Type or select an Alert name.
    When a triggered alert is distributed by email, this name is the email subject.
  11. To specify the alert frequency, select a tab.
    • To generate an alert for each event entry in the table, select Each.
    • To generate a single alert for a number of events (threshold) during the specified time period, select Several.
    • To generate a single alert when the number of events received (threshold) is less than indicated for the specified time period, select Low.
  12. (Optional) Create post filters.
    Post filters enable you to edit the features of the generated alerts before they are sent, as well as delete them if they meet specified criteria.
  13. Specify the delivery method.
    The delivery method dictates how the Advanced Visualization Tool sends an alert and to whom.
  14. (Optional) Create an anti-flooding policy.
    An anti-flooding policy enables complete, temporary suspension of alert generation when the rate of alerts exceeds the threshold you define.
  15. Create a sending policy and assign it to the alert you created.
    The new alert is automatically associated with the default sending policy. Alert policies, also called sending policies, define how the Advanced Visualization Tool sends alerts.

After you create your alert, the Advanced Visualization Tool monitors its queries and an alert triggers when the specified conditions are met. You can see triggered alerts on the Alerts Dashboard tab of the Alerts page. For more information, see Manage Available Alerts.

See Also

About Real-Time Alerts in the Advanced Visualization Tool

Manage Available Alerts