Alerts
Alerts allow you to receive instant email notifications when important events occur — such as when new software is installed, or a user opens a network share. Alerts are based on queries, and most predefined reports can be turned into alerts (with some limitations).
Prerequisites
- Currently, alerts are supported for the reports on Windows infrastructure only.
- To create, modify, or delete alerts, you will need an Action1 role with Manage Reports permission within the Organization scope or Enterprise scope.
- To receive the email alerts, make sure you allowlist Action1.Platform@<your region>.action1.com and www.action1.com email domain in your email settings.
Creating Alerts
To create a new alert based on the report:
- For the required report, select Create Alert from the Tools menu. Alternatively, navigate to Real-Time Reports & Alerts | Alerts and click “new alert rule“.
- Use Search to find the report (query) the alert should be based on.
NOTE: If the report does not appear in search results, this means that alerts aren’t currently supported for it.
- Specify the operation (an entity created, deleted, or modified) that will trigger the alert. Add any filters or logic to refine the alert.
Example: Notify the team whenever someone tries to install an instant messenger on a production server. - Specify the recipient’s email address.
NOTE: Currently, only one address can be entered.
- Make sure the Enable check box is selected for the alert.
- Finally, Save the new alert.
NOTE: Consider the following:
- To protect your inbox from overflowing, alerts will be suppressed if one alert rule generates more than 10 alerts per one hour from one endpoint (you will get notified in this case).
- To reduce alert triggering frequency, reconfigure the rules by applying additional filters.