Create alerts in Titan Secure

This feature is included with Titan Secure.

Alerts notify you in real time when something changes in your environment or in a vendor's security posture, so you can respond without manually checking for updates. An alert has three parts: a scope that defines whose data it watches, a condition that defines what to look for, and an action that defines what happens when that condition is met.

To create an alert, go to Automations > Alerts and select Create new alert.

How an alert is structured

Every alert follows a "scope, if this, then this" structure: the Scope section defines whose data the alert watches, the If section defines what to look for and where to look, and the Then section defines what happens once a match occurs. You can add multiple conditions and multiple actions to a single alert.

Set the alert scope

The Scope section defines whose findings and security events the alert monitors.

• Use the My organization / Monitored vendors toggle to choose whether the alert watches your own organization's data or a vendor's data from your portfolio.
• When the alert's data source (set in the If section, below) is Findings, an additional status dropdown appears so you can scope the alert to Open or Resolved findings. This dropdown is hidden when the data source is Security Events, since security events don't carry an open/resolved status.
  

Set the alert conditions (If)

The If section defines the specific condition the alert evaluates.

First, choose a data source: Findings or Security Events. This choice locks once you set a condition value below it, and you can't change it when editing an existing alert.

Below the data source selector, you build one or more conditions inside a group. Each group starts empty until you select the plus icon to add a condition. Every condition has a Subject, the field to evaluate (for example, a finding attribute or a vendor attribute), and a value to match against. Use the AND/OR dropdown next to a group to set how its conditions combine.

Select Add condition group to add a nested group of conditions. Each new group gets its own AND/OR setting, so you can combine conditions differently within each group.

Set the alert actions (Then)

The Then section defines what happens when the alert conditions are met.

1. Choose an Action type, such as Send Email or Trigger Workflow.
2. Choose the Recipients who receive the notification, or which workflow to trigger.
3. Choose a Frequency for how often the action runs. Digest groups matching results together and delivers them on a set schedule, rather than sending a separate notification for every individual match.

Select Add another action if you want the same alert to trigger more than one action.

Example: a complete alert

An alert scoped to My organization, with a data source of Findings filtered to Threat Level is High, and a Send email action set to a daily Digest frequency, notifies the chosen recipients on a recurring schedule whenever new open findings match the condition, instead of sending one email per finding.

View and manage your alerts

Go to Automations > Alerts to see every alert in your organization.

The table lists each alert with its name, status (Active or Inactive), creator, and last modified and last run dates. Use the search bar to find an alert by name, or select Filters to filter the list by status, scope, owner, tags, or last triggered date.

To manage an existing alert, select the Row actions (...) icon at the end of its row. From there, you can:

• Edit: Change the alert's scope, conditions, or actions.
• Duplicate: Create a copy of the alert to modify.
• Activate or Disable: Turn the alert on or off without deleting it. Active alerts show Disable; inactive alerts show Activate instead.
• Delete: Permanently remove the alert.