---
locale: "en"
updated_at: "2026-07-16T16:05:09.004Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/guides/operations/manage-alerts"
---

# Manage alerts

Create, configure, edit, and delete alert rules tab by tab

## Before you begin

FileAudit alerts notify you, and can run an automated response, when access events match conditions you define. This guide covers creating single-access and mass-access alerts, and editing, enabling, disabling, and deleting them. 

Make sure the following are in place:

- **Windows auditing is active on the paths you want to watch.** 
An alert only fires on access events captured by the audit engine; a path that isn't audited produces no events. 
See [Manage Windows audit](/fileaudit/docs/guides/operations/manage-windows-audit) Guide.
- **The email server is configured.** 
Alerts require at least one recipient and are delivered by email, so the mail server must be set up first. 
See [Configure email settings](/fileaudit/docs/guides/configuration/configure-email-settings) Guide.

> **Note**
>
> For how alerts work and what each setting does, see [Alerts](/fileaudit/docs/reference/alerts) Reference.

## Create a single-access alert

A single-access alert triggers on the first access event that matches its filters, and raises one alert per matching event. Use it to watch a specific sensitive file or folder, or to catch individual suspicious actions.

For the difference between single and mass alerts, see [Alerts → Single alerts and mass alerts](/fileaudit/docs/reference/alerts#single-alerts-and-mass-alerts) Reference.

1. In the FileAudit hub, click the **Alerts** tile.
  ![Dashboard alerts](https://a.storyblok.com/f/122374/1298x826/915b576b80/dashboard-alerts.png)
2. Under **Single access**, click the purple **Add** tile. 
The Alert configuration screen opens on the **Main** tab.
  ![Add a single access alert](https://a.storyblok.com/f/122374/1298x826/17bb53eeb3/select-a-single-alert.png)
3. On the **Main** tab, enter an **Alert name**. This name identifies the alert on its tile, so make it specific (for example, `Read access - HR payroll folder`).
4. Leave **Enabled** set to **Yes** to activate the alert as soon as you save, or set it to **No** if you want to configure it now but keep it inactive for later.
5. Set the triggering **filters** under **What**, **Who**, and **Source**. Each filter you set is a condition the event must match; an empty field is not used.
  - See [Filters](/fileaudit/docs/reference/filters) Reference for what each field means and its possible values.
  - To target several accounts, or to exclude some, use the include/exclude syntax. See [Include or exclude users](/fileaudit/docs/reference/filters#include-or-exclude-users) Reference.
  ![Alert configuration](https://a.storyblok.com/f/122374/796x696/fe7525f575/alert-configuration-main.jpg)
6. Open the **Paths** tab and add at least one path. An alert with no path never fires.
  - Click **Add a Windows path** or **Add a Cloud path**, browse to the file or folder, and click **Validate**. Repeat to add more.
    > **Tip**
    >
    > The **Paths** field of the alert supports ***** (any string) and **?** (any character) wild characters.
  - If the path isn't audited yet, FileAudit offers to set it up through its wizard. See [Manage Windows audit](/fileaudit/docs/guides/operations/manage-windows-audit) Guide.
  ![Alert : add a Windows or Cloud path](https://a.storyblok.com/f/122374/656x378/7ee2dc49a5/alert-add-windows-cloud-path.png)
7. *(Optional)* Open the **Excluded hours** tab to silence the alert during chosen periods, such as business hours. Turn on **Disable alert during specified hours** and set a time range per day. The access is still audited; only the notification is suppressed.
  ![Alert configuration - Excluded hours](https://a.storyblok.com/f/122374/940x628/54e0d6f2a3/alert-configuration-excluded-hours.png)
8. Open the **E-mail** tab and add at least one recipient. The alert will not save without one.
  - Click **Add a recipient** to enter a new name and address, or pick an existing stored recipient.
  - Edit the **Subject** and **Content** templates if you want. They support dynamic variables such as `{UserName}` (see [Alerts → Notifications](/fileaudit/docs/reference/alerts#notifications) Reference).
  - To deliver alerts to Teams or Slack instead of a mailbox, see [Send alert notifications to Teams or Slack](/fileaudit/docs/guides/configuration/send-alerts-to-teams-or-slack) Guide.
  ![Alert configuration - E-mail](https://a.storyblok.com/f/122374/1298x830/f3cbbcda45/alert-configuration-email.png)
9. *(Optional)* Open the **Execution** tab to run an automated response when the alert triggers.
  - In the **Add new action** form, point to any executable you provide (.bat, .exe, or .ps1) with its own arguments and credentials.
  - Or click **View scripts** to use a predefined script for a common response such as logging off or disabling an account, so you don't have to write your own.
  - Select a script from the **Executed action** list to attach it.
  ![Alert configuration Execution Script](https://a.storyblok.com/f/122374/1011x588/cc11e14faa/alert-configuration-execution-scripts.png)
  > **Note**
  >
  > ⚠️ **Important:** Execution scripts can disable accounts and shut down machines. Test a script against a non-critical account before attaching it to a live alert.
10. Click **Save** (top right). The alert is active immediately.

## Create a mass-access alert

A mass-access alert triggers when a single user produces a volume of matching events over a time window, raising one alert that aggregates the activity. Use it to catch ransomware-like bursts, abnormal modification spikes, or bulk deletions. 

For the difference between single and mass alerts, see [Alerts → Single alerts and mass alerts](/fileaudit/docs/reference/alerts#single-alerts-and-mass-alerts) Reference.

1. In the FileAudit hub, click the **Alerts** tile, then under **Mass access** click the purple **Add** tile.
  ![Select a mass alert](https://a.storyblok.com/f/122374/760x367/b20778c698/select-a-mass-alert.png)
2. Configure the alert exactly as you would a single-access alert (see [Create a single-access alert](#create-a-single-access-alert)). A mass-access alert uses the same tabs and the same mandatory items.
3. On the **Main** tab, set the **Frequency** filters that define the burst to detect:
  - **Threshold**: the number of matching events required to trigger the alert.
  - **Time period**: the rolling window over which the threshold is counted.
  - **Latency period**: how long the alert stays disabled after firing, to avoid repeated alerts on the same burst. Set it to `0` to trigger on every event past the threshold.
  ![Alert configuration mass access](https://a.storyblok.com/f/122374/1024x680/402d316984/alert-configuration-mass-access.png)
4. Click **Save** (top right). The alert is active immediately.

> **Tip**
>
> To contain a spreading attack automatically, pair a mass-access alert with a ransomware script on the **Execution** tab. See [How to Detect Ransomware](/fileaudit/docs/guides/configuration/how-to-detect-ransomware) Guide.

## Edit an alert

1. In the FileAudit hub, click the **Alerts** tile.
2. Click the tile of the alert you want to change.
3. Change any setting across the tabs, then click **Save**.

![Alert configuration](https://a.storyblok.com/f/122374/796x696/fe7525f575/alert-configuration-main.jpg)

> **Note**
>
> Changes take effect as soon as you save.

## Enable or disable an alert

Disabling an alert stops it from firing without deleting its configuration, so you can turn it back on later. Disabling an alert does not stop the underlying audit: matching access is still recorded.

1. In the FileAudit hub, click the **Alerts** tile.
2. Click the tile of the alert you want to enable or disable.
3. On the **Main** tab, set the **Enabled** switch to **Yes** or **No**.
4. Click **Save**.

![Alert Configuration not enabled](https://a.storyblok.com/f/122374/766x680/264e4ad8d7/alert-configuration-not-enabled.png)

## Delete an alert

Deleting an alert removes its configuration permanently. This does not affect the audit on the monitored paths.

1. In the FileAudit hub, click the **Alerts** tile.
2. Click the tile of the alert you want to remove.
3. Click **Delete** (top right).
4. Confirm by clicking **OK**.

![Delete alert](https://a.storyblok.com/f/122374/455x366/d3f75c6a80/delete-alert.png)