2.10 Alarms Module
The Alarms module serves as the centralized incident response hub, consolidating all security alerts into a single interface with real-time status tracking and analytical dashboards, as shown in Figure 2.10-1.
Figure 2.10-1 – Alarms Dashboard
2.10.1 Alarm List Panel
The left panel displays the Alarm List with a paginated view of all security alarms, as shown in Figure 2.10.1-1.
Figure 2.10.1-1 – Alarm List Panel
2.10.1.1 List Header and Controls
The alarm list header displays the current page scope (e.g., "17 of 17") and provides sort and filter controls:
Control | Function |
|---|---|
Newest First | Sort dropdown for alarm ordering (Newest First, Oldest First) |
Advanced Filters | Expand detailed filtering options |
2.10.1.2 Search Bar
A Search alarms text bar allows quick filtering by multiple criteria. The placeholder text reads: "Search alarms (type, IP, guardpot name, status, etc.)"
2.10.1.3 Advanced Filters
Clicking the Advanced Filters button expands a detailed filtering panel with the following options:
Filter | Description |
|---|---|
Attack Type | Select the alarm category type |
Attacker IP | Filter by source attacker IP address |
Guardpot IP | Filter by honeypot IP address |
Guardpot Name | Filter by specific honeypot name |
Status | Filter by alarm status (Waiting for Action, In Process, Completed, Ignored) |
Assignment | Filter by assigned responder |
2.10.1.4 Alarm Card Structure
Each alarm in the list is displayed as a card with the following information:
Field | Description |
|---|---|
Status Indicator | Color-coded dot indicating current state: In Process (blue), Completed (green), Waiting (red), Ignored (yellow) |
Alarm Type | Category label (e.g., "MailPot Alert", "PotGuard") |
Tags | Contextual classification tags (e.g., "MailPot SUSPICIOUS", "MailPot NORMAL", "WireGuard Config") |
Associated IP | Source IP address related to the alarm (e.g., |
Timestamp | Date and time of alarm generation (e.g., "17.02.2026 15:17:09") |
Status Button | Current state button: In Process, Completed, Waiting for Action, or Ignored |
Clicking an alarm card or its detail arrow (>) opens the full alarm investigation view.
2.10.2 Analytical Panels
The right panel provides three analytical dashboards for alarm metrics as shown in Figure 2.10.2-1.
Figure 2.10.2-1 – Analytical Panels
2.10.2.1 Alarm Status — Distribution by Status
A pie chart visualizes the proportional distribution of alarms by their current state:
Status | Description |
|---|---|
Waiting for Action | New, unassigned alarms requiring review |
In Process | Alarms currently under investigation |
Completed | Resolved and closed alarms |
Ignored | Dismissed alarms (false positives or accepted risk) |
The chart legend displays each status with its corresponding count and color coding.
2.10.2.2 Alarm Timeline — Alarms Over Time
A line chart titled "Alarm Timeline" with the subtitle "Alarms over time" displays alarm volume trends over a configurable time period, enabling identification of attack surges and patterns.
2.10.2.3 Average Solve Time — Response Time Metrics
An area chart titled "Average Solve Time" with the subtitle "Response time metrics" tracks the mean time to resolution (MTTR) for completed alarms, monitoring and team performance evaluation.