5.1 Alert Rules
5.1.1 Alarms Module Overview#
The Alarms module (see Section 2.10) serves as the centralized incident response hub, consolidating all security alerts into a single interface with real-time status tracking and analytical dashboards.
5.1.2 Alarm List#
The left panel displays the Alarm List with a paginated view of all security alarms (see Section 2.10.1). The alarm list header provides sort and filter controls including Newest First sorting and Advanced Filters.
A Search alarms text bar allows quick filtering by multiple criteria with the placeholder text: "Search alarms (type, IP, guardpot name, status, etc.)"
Advanced Filters expands a detailed filtering panel:
Filter | Description |
|---|---|
Attack Type | Select the alarm category type |
Attacker IP | Filter by source attacker IP address |
Guardpot IP | Filter by honeypot IP address |
Guardpot Name | Filter by specific honeypot name |
Status | Filter by alarm status (Waiting for Action, In Process, Completed, Ignored) |
Assignment | Filter by assigned responder |
5.1.3 Alarm Card Structure#
Each alarm in the list is displayed as a card (see Section 2.10.1.4) with the following information:
Field | Description |
|---|---|
Status Indicator | Color-coded dot: ● In Process (blue), ● Completed (green), ● Waiting (red), ● Ignored (yellow) |
Alarm Type | Category label (e.g., "MailPot Alert", "PotGuard") |
Tags | Contextual classification tags (e.g., "MailPot SUSPICIOUS", "MailPot NORMAL", "WireGuard Config") |
Associated IP | Source IP address related to the alarm |
Timestamp | Date and time of alarm generation |
Status Button | Current state: In Process, Completed, Waiting for Action, or Ignored |
Clicking an alarm card or its detail arrow opens the full alarm investigation view.
5.1.4 Analytical Panels#
The right panel provides three analytical dashboards for alarm metrics (see Section 2.10.2):
Alarm Status — Distribution by Status: A pie chart visualizes the proportional distribution of alarms by state:
Status | Description |
|---|---|
Waiting for Action | New, unassigned alarms requiring review |
In Process | Alarms currently under investigation |
Completed | Resolved and closed alarms |
Ignored | Dismissed alarms (false positives or accepted risk) |
Alarm Timeline — Alarms Over Time: A line chart displays alarm volume trends over a configurable time period, enabling identification of attack surges and patterns.
Average Solve Time — Response Time Metrics: An area chart tracks the mean time to resolution (MTTR) for completed alarms, supporting monitoring and team performance evaluation.
5.1.5 Event-Based Trigger Policies#
The Event sub-tab within the Settings Policies tab (see Section 2.15.2.2) manages event-based trigger policies. The Event Policy List displays configured policies with total count. When no policies exist, an empty state message displays: "No Data"
Left Sidebar Menu:
Menu Item | Description |
|---|---|
Alert Policy | Configure alert notification rules for event triggers |
New Policy | Create new event-based policies |
5.1.6 Creating a New Event Policy#
Click New Policy in the left sidebar (see Section 2.15.2.2.2) to open the event policy creation form with the following parameters:
Parameter | Description |
|---|---|
Name | A descriptive name for the event policy |
Agent | Select a Guardpot agent from the dropdown |
IP List | IP address filter with ANY toggle option |
Attack Type List | Select attack types with ANY toggle option |
Available Attack Types: database, web, ssh, dns, portscan.
5.1.7 Interaction Monitoring Rules#
The Interaction sub-tab within the Settings Policies tab (see Section 2.15.2.3) manages interaction monitoring rules. The Interaction Policy List displays configured policies. When no policies exist, an empty state message displays: "No Data"
Left Sidebar Menu:
Menu Item | Description |
|---|---|
Alert Policy | Configure alert notification rules for interaction events |
New Policy | Create new interaction-based policies |
5.1.8 Creating a New Interaction Policy#
Click New Policy in the left sidebar (see Section 2.15.2.3.2) to open the interaction policy creation form with the following parameters:
Parameter | Description |
|---|---|
Name | A descriptive name for the interaction policy |
Guardpot | Select a Guardpot agent from the dropdown |
IP List | IP address filter with ANY toggle option |
Interaction Type | Select the interaction type to monitor |
Find Detail | Search pattern field. Use |
5.1.9 MailPot Alert Policies#
The Policies tab within the MailPot module (see Section 2.6.4) configures automated alert rules for mailbox threat detection. Each configured policy is displayed as a card with mailbox name, status, alert states (🗑️ Spam, ⚠️ Phishing), monitoring description, notification channels, recipients, and alert message template.
Click Add New Policy to create an alert policy, or click Edit on an existing policy card (see Section 2.6.4.3) to modify configuration:
Parameter | Description |
|---|---|
Mailbox to Monitor | Select the email account to monitor |
Alert State — select one or both:
Threat Type | Description |
|---|---|
Spam | Detect spam emails |
Phishing | Detect phishing attempts |
Alert Configuration:
Parameter | Description |
|---|---|
Alert Recipients | Select users or roles to receive ale### 5.1.1 Alarms Module Overview |
The Alarms module (see Section 2.10) serves as the centralized incident response hub, consolidating all security alerts into a single interface with real-time status tracking and analytical dashboards.
5.1.2 Alarm List#
The left panel displays the Alarm List with a paginated view of all security alarms (see Section 2.10.1). The alarm list header provides sort and filter controls including Newest First sorting and Advanced Filters.
A Search alarms text bar allows quick filtering by multiple criteria with the placeholder text: "Search alarms (type, IP, guardpot name, status, etc.)"
Advanced Filters expands a detailed filtering panel:
Filter | Description |
|---|---|
Attack Type | Select the alarm category type |
Attacker IP | Filter by source attacker IP address |
Guardpot IP | Filter by honeypot IP address |
Guardpot Name | Filter by specific honeypot name |
Status | Filter by alarm status (Waiting for Action, In Process, Completed, Ignored) |
Assignment | Filter by assigned responder |
5.1.3 Alarm Card Structure#
Each alarm in the list is displayed as a card (see Section 2.10.1.4) with the following information:
Field | Description |
|---|---|
Status Indicator | In Process (blue), Completed (green), Waiting (red), Ignored (yellow) |
Alarm Type | Category label (e.g., "MailPot Alert", "PotGuard") |
Tags | Contextual classification tags (e.g., "MailPot SUSPICIOUS", "MailPot NORMAL", "WireGuard Config") |
Associated IP | Source IP address related to the alarm |
Timestamp | Date and time of alarm generation |
Status Button | Current state: In Process, Completed, Waiting for Action, or Ignored |
Clicking an alarm card or its detail arrow opens the full alarm investigation view.
5.1.4 Analytical Panels#
The right panel provides three analytical dashboards for alarm metrics (see Section 2.10.2):
Alarm Status — Distribution by Status: A pie chart visualizes the proportional distribution of alarms by state:
Status | Description |
|---|---|
Waiting for Action | New, unassigned alarms requiring review |
In Process | Alarms currently under investigation |
Completed | Resolved and closed alarms |
Ignored | Dismissed alarms (false positives or accepted risk) |
Alarm Timeline — Alarms Over Time: A line chart displays alarm volume trends over a configurable time period, enabling identification of attack surges and patterns.
Average Solve Time — Response Time Metrics: An area chart tracks the mean time to resolution (MTTR) for completed alarms, supporting monitoring and team performance evaluation.
5.1.5 Event-Based Trigger Policies#
The Event sub-tab within the Settings Policies tab (see Section 2.15.2.2) manages event-based trigger policies. The Event Policy List displays configured policies with total count. When no policies exist, an empty state message displays: "No Data"
Left Sidebar Menu:
Menu Item | Description |
|---|---|
Alert Policy | Configure alert notification rules for event triggers |
New Policy | Create new event-based policies |
5.1.6 Creating a New Event Policy#
Click New Policy in the left sidebar (see Section 2.15.2.2.2) to open the event policy creation form with the following parameters:
Parameter | Description |
|---|---|
Name | A descriptive name for the event policy |
Agent | Select a Guardpot agent from the dropdown |
IP List | IP address filter with ANY toggle option |
Attack Type List | Select attack types with ANY toggle option |
Available Attack Types: database, web, ssh, dns, portscan.
5.1.7 Interaction Monitoring Rules#
The Interaction sub-tab within the Settings Policies tab (see Section 2.15.2.3) manages interaction monitoring rules. The Interaction Policy List displays configured policies. When no policies exist, an empty state message displays: "No Data"
Left Sidebar Menu:
Menu Item | Description |
|---|---|
Alert Policy | Configure alert notification rules for interaction events |
New Policy | Create new interaction-based policies |
5.1.8 Creating a New Interaction Policy#
Click New Policy in the left sidebar (see Section 2.15.2.3.2) to open the interaction policy creation form with the following parameters:
Parameter | Description |
|---|---|
Name | A descriptive name for the interaction policy |
Guardpot | Select a Guardpot agent from the dropdown |
IP List | IP address filter with ANY toggle option |
Interaction Type | Select the interaction type to monitor |
Find Detail | Search pattern field. Use |
5.1.9 MailPot Alert Policies#
The Policies tab within the MailPot module (see Section 2.6.4) configures automated alert rules for mailbox threat detection. Each configured policy is displayed as a card with mailbox name, status, alert states (🗑️ Spam, ⚠️ Phishing), monitoring description, notification channels, recipients, and alert message template.
Click Add New Policy to create an alert policy, or click Edit on an existing policy card (see Section 2.6.4.3) to modify configuration:
Parameter | Description |
|---|---|
Mailbox to Monitor | Select the email account to monitor |
Alert State — select one or both:
Threat Type | Description |
|---|---|
Spam | Detect spam emails |
Phishing | Detect phishing attempts |
Alert Configuration:
Parameter | Description |
|---|---|
Alert Recipients | Select users or roles to receive alerts (e.g., Admin) |
Alert Message Template | Customize using template variables. Default: |
Available Template Variables:
Variable | Description |
|---|---|
| Email sender address |
| Threat category (Spam, Phishing, etc.) |
| Email subject line |
rts (e.g., Admin) | |
Alert Message Template | Customize using template variables. Default: |
Available Template Variables:
Variable | Description |
|---|---|
| Email sender address |
| Threat category (Spam, Phishing, etc.) |
| Email subject line |
Was this article helpful?
Your feedback helps us improve the documentation.