Alerts

All alerts

Alerts → All alerts (/detection/events) lists security events from endpoints (Wazuh) and from the network (NIDS, when a sensor is configured), with a normalised severity.

Find events

• Severity cards (Critical, High, Medium, Low) filter when clicked.
• Search across events, IPs, signatures and rule IDs.
• Filters: severity, source, group; advanced: rule ID, source IP, destination IP, category, agent.
• Hide manager logs hides events of the manager itself (agent 000).
• Show columns chooses the columns: severity, time, source, event, source and destination IP, agent or sensor, category, details.

Act on an event

Action	What it does
AI analysis	An AI report: summary, analysis, attack chain, mitigation steps, affected asset, MITRE ATT&CK, IOCs, IP threat intelligence. Needs an LLM endpoint
Mute alert	Suppresses matching events. See below
Block source IP	Blocks the address at your perimeter (AWS or Cloudflare). See Response

Select several rows to Block N IPs or Mute N alerts at once.

Mute an alert

A mute suppresses future events that match its conditions.

1. Choose Mute alert on an event.
2. Pick the conditions: for Wazuh alerts, rule ID and source IP; for NIDS alerts, signature ID, source IP and destination IP. A mute must include a rule or signature ID; an IP alone is refused, because it would not suppress anything at the sensor.
3. Pick a classification: False positive, Known benign or Tuning, and write a reason.

Mutes are permanent until you deactivate them; they have no expiry.

Muted rules

Alerts → Muted rules lists every mute: conditions, source, classification, hits, status and sync state (synced, pending, pending reload, failed).

• Sync now pushes mutes to the sensors again.
• Edit changes the reason (conditions cannot change: create a new mute).
• Deactivate, Reactivate, Delete.

Alert triage

Alerts → Alert triage opens Pallas's triage view inside the console. It needs the ai module. See Pallas.