Alerts

FileAudit alerts are evaluated against collected access events in real time. An alert triggers when an event matches every condition defined in its rule.

Alert generation depends on three things being in place:

• Windows object access auditing is active

• The accessed path is monitored

• The alert rule is enabled

When an alert triggers, FileAudit records it and acts on it: it sends a notification by email to the recipients defined in the alert, and can run an automated response if one is attached. Both are covered below.

Every triggered alert is also logged in the Alert history report.

FileAudit provides two alert types. They share the same filters but differ in what triggers them.

A mass alert is defined by its Frequency filters (see below). A single alert ignores those fields and fires on the first matching event.

Filters define which events an alert reacts to. They are grouped under What, Who, and Source on the Main tab, and a path scope is set on the Paths tab.

An alert triggers only when an event matches every filter set on the rule. A filter you leave empty is not used as a condition, so the more fields you set, the narrower the alert.

On the Paths tab you scope the alert to one or more monitored Windows or Cloud paths; an alert with no path is not scoped to any resource and never triggers. The Paths tab supports * (any string) and ? (any character) wild characters.

Mass alerts add a Frequency group on the Main tab, which turns a stream of individual events into a single alert when one user crosses a volume threshold. Three fields define the burst to detect:

• Threshold,

• Time period,

• Latency period.

For each field's definition, see Filters → Frequency filters Reference.

A single alert ignores these fields and fires on the first matching event.

For example, a threshold of 100 over a 1 minute time period raises one alert when 100 matching events occur within any 1 minute window. This is the basis for ransomware detection: see How to detect ransomware with FileAudit Guide for a configured example.

The Excluded hours tab disables an alert during defined periods. Events occurring inside an excluded range do not trigger it.

Exceptions support:

• Excluded time ranges per day of the week

• Recurring weekly schedules

Use this to align alerting with business hours, scheduled maintenance, or other expected activity windows that would otherwise generate noise.

When an alert triggers, FileAudit can send a notification. Channels are set on the E-mail tab and in the alert rule:

• Email to one or more recipients

• Teams or Slack, through the email notification mechanism

See Configure email settings Guide to set up the mail server, and Send alert notifications to Teams or Slack Guide for the chat integration.

The triggering events and recipients are defined as part of the rule configuration.

The email content itself can be personalized: you can modify the Subject and Content templates as desired. Dynamic variables are enclosed in curly brackets { }, and the available variables differ depending on the type of alert: single or mass.

The Execution tab runs a response automatically when the alert triggers, turning an alert into containment rather than just a notification.

FileAudit provides predefined scripts so you do not have to write your own. Each script combines one or more atomic actions:

Predefined scripts are assortments of these actions, grouped into two families:

• Standard scripts: general-purpose responses, from a single action (Disable user, Log off user, Shut down computer) up to combinations such as Log off & disable user and computer accounts.

• Ransomware scripts: a focused subset built for fast containment of a spreading attack, centered on logging off and disabling the offending account, optionally with its computer account.

You can also run a custom executable instead, with its own working directory, parameters, and domain context.

Pair a ransomware script with a mass alert: the mass alert detects the burst of activity, and the script contains the account or machine before damage spreads.

See Manage alerts Guide to configure alert rules and attach an execution script.