Alerts and issues

Both are under Detections, and they answer different questions. An alert records something that happened, once. An issue is something that stays true until it is fixed, and it is triaged.

Neither creates the other: an alert never opens an issue, and an issue never raises an alert.

Alerts

A policy raises an alert in two ways:

• its Raise an alert or Notify action matches;
• a person the policy asked, with Require a reason on, gives a reason and goes ahead. The list calls this a justified override.

A plain block is not an alert, and neither is an Ask the person declined or let time out. Each is a decision, listed in Governance › Runs, and on the interaction it was about.

An alert has no triage. Open one to read what the policy saw, what was asked and, for a justified override, why the person went ahead. Its Related list opens the decision in Runs.

The list can be narrowed by severity, policy, what raised it, the policy's state, the AI service, the machine and when.

Issues

An issue is filed by a policy's Open an issue action — a Host policy about a file on a machine, a Connector policy about a record on a platform. Some of these policies are Provided by Oxelone. The only issues no policy files are a few built-in checks on the agent itself.

An issue moves through four states:

• Open — new, or found again.
• Acknowledged — someone has seen it.
• Resolved — fixed. It reopens if a later scan finds the same thing.
• Suppressed — set aside. It does not reopen.

An issue can also be muted, with a reason, and it has a discussion for comments. The list can be grouped by policy or by what the issue is about.

When a machine or a connection is removed

Its open issues are closed. Its alerts and decisions are kept as history, and the Alerts list shows them under Include removed.