Cisco Cyber Vision New UI Administration Guide, Release 5.6.0

Alerts

Updated: September 8, 2026

Want to summarize with AI?

Defines alerts as security notifications that categorize issues by status and severity, providing information to help you investigate and respond to security events.

An alert is a security notification that informs users about potential or detected security issues, categorizes each issue by its current status and severity, and provides detailed information to help users investigate and respond effectively.

Alerts inform users about potential or detected security issues.
Alerts categorize each issue by its current status (active, muted, cleared) and severity (critical, high, medium, low).
Alerts provide detailed information to help users investigate and respond effectively.

Alert categories, severity levels, and key attributes

Alerts are organized by categories, severity levels, and key attributes to help users prioritize and respond to security events.

Table 1. Alert categories
Category	Description
Active	Alerts that are currently open and require attention.
Muted	Alerts that have been temporarily silenced.
Cleared	Alerts that have been resolved or acknowledged.

Table 2. Alert severity levels
Severity	Description
Critical	Indicates high-priority issues requiring immediate action.
High	Represents significant security events.
Medium	Denotes moderate-level concerns.
Low	Flags informational issues.

Table 3. Key alert attributes
Attribute	Description
Alert Type	Describes the nature of the alert (for example, login from prohibited location).
Trigger	Identifies the event or condition that caused the alert.
Instances	Shows how many times the specific trigger occurred.
Category	Groups the alert by type (for example, user activity).
Last Detected	Time of the most recent occurrence.
Severity	Indicates the impact level (for example, medium).

To view detailed information of an alert, click the field in the Trigger column, then the corresponding number in the Occurrences column.

For example, if a user logs in from a prohibited location, an alert is generated with Critical severity. The alert appears as active until it is acknowledged or resolved, and users can click the Trigger and Occurrences columns to investigate further.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.