Skip to navigation
Secure

Violations and alerts

Investigate what your security rules are catching

Every Security Gateway match is recorded as a violation, whatever the action. Review them on the Alerts page to find false positives and gather evidence for reviews.

Alerts page

PanelShows
Violations over timeViolation count and total for the window
Rule violations breakdownShare by entity type. Click a slice to filter the page.
Violation tableTime, Connector, tool, entity type, employee, action, and tags. Click a row to open the tool call.

Filter by date, entity type, tool name, Connector, and employee. Filters combine.

Investigate a spike

  1. Find the spike on Violations over time.
  2. Click the responsible slice in the breakdown.
  3. Open a row and read the arguments and result.
  4. Decide whether the match was real.

Act on findings

  • Too aggressive: add context keywords, or override the entity on the Tool Pack that needs the data.
  • Too lenient: broaden the pattern, or move from Log to Redact, or Redact to Block.
  • Unexpected tool calls: narrow access in Groups and access.

Retention and export

Violations are kept for your data retention window. To export, pull redacted and blocked calls from tool call logs and stream them to a SIEM. Log endpoints are an Enterprise feature.