Working with reseller alerts

Alerts are a single place to see security events that have fired across all your clients. Anything the plugin considers worth raising — a critical scan finding, a suspicious sign-in attempt, a connectivity problem — surfaces as an alert against the relevant client. The Alerts page lets you triage them in one list rather than logging into each client to find out what is going on.

In This Article

• Severity levels
• Filtering the list
• Dismissing alerts
• A practical alert workflow

Severity levels

Every alert carries one of three severities:

• Critical. Something is actively wrong and the client is exposed right now — an unresolved malware finding, a firewall that has been turned off, or a brute-force attempt that succeeded. Critical alerts should be treated as same-day work.
• Warning. Something is off and worth fixing within a few days, but the client is not in immediate danger — outdated plugins, weak passwords detected during an audit, scans that have missed their schedule, etc.
• Info. Notifications that are useful to know but do not require action — for example, a successful scan completing or a configuration change being applied.

Filtering the list

Two filters at the top of the page narrow the list:

• Severity. Show only critical, warning, or info alerts.
• Dismissed. Show only active (undismissed) alerts, only previously dismissed ones, or both.

The default view is “active alerts, all severities” which is the right starting point for daily triage. Switch to “dismissed” when you are looking for a previously seen alert that you have already actioned.

Dismissing alerts

Once you have actioned an alert — or decided that no action is needed — dismiss it to clear it from the active view. Dismissal does not delete the alert; it stays in the history under the “Dismissed” filter so you have a record of what was raised and when. Use the “Dismissed” filter periodically to audit how often a given client is generating alerts; a client that generates a steady stream of warnings often needs a deeper review than dismiss-as-they-arrive.

A practical alert workflow

1. Start the day on Alerts with the default filter (active, all severities).
2. Work the critical alerts first, in the order they fired. Open each affected client’s detail page from the alert and resolve.
3. Move to warnings. Group by client where possible — if one site has three warnings, fix them together rather than flipping back and forth.
4. Skim info alerts to make sure nothing surprising is hiding among them, and dismiss the routine ones.

If you find that a particular client is consistently the source of alerts and your interventions are not sticking, that is a signal to look at the underlying configuration on their site rather than continuing to work the symptoms one alert at a time.