Cisco Cyber Vision New UI Administration Guide, Release 5.6.0

PDF

Cisco Cyber Vision New UI Administration Guide, Release 5.6.0

Alert rules

Updated: September 8, 2026

Want to summarize with AI?

Log in

Define alert rules to help detect unusual user activities, specify monitored behaviors, and outline how alerts are presented for action.

An alert rule is a security monitoring policy that defines specific user activities or behaviors to watch for, triggers an alert when these activities deviate from expected patterns or violate set policies, and presents such alerts in the system for review and management.

  • Defines specific user activities or behaviors to monitor.

  • Triggers an alert when monitored activities deviate from expected patterns or violate set policies.

  • Presents alerts in the system for review and management.

Additonal reference information

When an alert rule detects an unusual activity, it triggers an alert that appears in the Alerts tab. In this tab, you can review alert details, sort by severity, and take further action as needed. Alert rules help organizations automatically identify and respond to potential security incidents by continuously monitoring user activity patterns.

  • Detecting logins from locations outside a user's typical countries.

  • Detecting logins from countries disallowed by your organization’s policies.

  • Detecting logins occurring outside of standard working hours for a user.

Alerts configuration page details

The Alerts configuration page provides the following details about alert types, categories, rules, and actions.

Table 1. Alerts configuration page columns

Column

Description

Alert Type

The name of the alert policy. Each is a clickable link to view or edit details. Examples:

  • Changed Login Location

  • Login From Prohibited Location

  • Login Outside of Working Hours

Alert Category

The category of the alert. In this case, all are under User Activity .

Alert Rules

The number of active rules associated with each alert type.

Last Updated

Shows when the alert configuration was last modified.

Action

Lets you control the alert’s state:

  • Pause (red): Temporarily disables an active alert.

  • Resume (blue): Reactivates a paused alert.
Note

You can configure multiple alert rules within each category to trigger alerts for different scenarios.

Configure alert rules for login from prohibited locations

Set up alerts to notify administrators when users log in to CV SRA from blocked or unapproved countries.

Before you begin

  • Determine which countries should be allowed or blocked according to organizational policies.

  • Set a rule definition using either an Allowlist or Blocklist. The Allowlist should include locations to permit, while the Blocklist should list locations to flag.

Procedure

  1. On the Alerts page, click Login From Prohibited Location .

    The Login From Prohibited Location page displaying the default configuration appears. By default, the severity of the rules is medium.

  2. To modify the default rule definition and severity:

    1. Click Edit .
    2. In the Edit Configuration panel, set the default severity level of the alert to Critical, High, Medium, or Low, depending on how urgently the alert should be addressed.
    3. Select the rule definition, either Blocklist or Allowlist.
    4. Click Save .

  3. To configure an alert rule:

    1. Click Add on the Login From Prohibited Location page.
    2. In the Configure Alert section, select the scope of users the alert applies to:

      • All users – Default option. Applies the alert to all users.

      • Selected user roles – Apply the alert to users assigned to specific user roles. For example, SRA users.

      • Selected access control groups – Apply the alert to users in specific access control groups.

  4. To add locations to the rule definition, select a country from the Add Location drop-down list, and click Add .

    • The selected country is added to the configured rule definition. You can add as many countries as you want.

    • If your configured rule definition is Allowlist, then an alert will be triggered when users access CV SRA from locations other than the ones you added.

    • If your configured rule definition is Blocklist, then an alert will be triggered when users access CV SRA from the locations you just added.

  5. Click Next .

  6. To set email notifications, specify who should receive email alerts in the Set Notification section:

    • Selected Users – Choose this option to send notifications to specific users. For example, SRA users.

    • Selected User Roles – Choose this option to notify users assigned to specific roles.

    • Do not send email notification – Select this option if you do not want email notifications to be sent when the alert is triggered.

  7. Click Next .

  8. To enter a rule name and review the details:

    1. On the Review page, enter a rule name in the Alert Rule Name field.
    2. Verify all the configured alert details.
    3. Click Back to navigate to the previous pages and make changes.

  9. Click Create to save the alert rule and enable it.

The new alert rule is added to the Login From Prohibited Location configuration.

When a user logs in to CV SRA from a country that is configured in the Allowlist, no alert is generated. When a user logs in from a country that is in the Blocklist, an alert is generated.

Note

Blocklist does not really block users from accessing CV SRA.

Configure alert rules for changed login locations

Set up alerts that notify administrators when users log in to CV SRA from locations different from their previous access points.

This process helps identify suspicious account activity and potential security incidents by monitoring users’ login locations.

Before you begin

  • Decide which user roles or groups should be monitored.

Procedure

  1. On the Alerts page, click Changed Login Location .

    The Changed Login Location page appears, allowing you to configure the alert settings. This page lists the changed login location alert rules you have previously configured. By default, the severity of the rules is medium.

  2. To modify the default severity:

    1. Click Edit .
    2. In the Edit Configuration panel, set the default severity level of the alert to Critical, High, Medium, or Low, depending on how urgently the alert should be addressed.
    3. Click Save .

  3. To configure an alert rule:

    1. Click Add on the Changed Login Location page.
    2. In the Configure Alert section, select the scope of users the alert applies to:

      • All users – Default option. Applies the alert to all users.

      • Selected user roles – Apply the alert to users assigned to specific user roles.

      • Selected access control groups – Apply the alert to users in specific access control groups.

  4. Click Next .

  5. To set email notifications, specify who should receive email alerts in the Set Notification section:

    • Selected Users – Choose this option to send notifications to specific users.

    • Selected User Roles – Choose this option to notify users assigned to specific roles.

    • Do not send email notification – Select this option if you do not want email notifications to be sent when the alert is triggered.

  6. Click Next .

  7. To enter a rule name and review the details:

    1. On the Review page, enter a rule name in the Alert Rule Name field.
    2. Verify all the configured alert details.
    3. Click Back to navigate to the previous pages and make changes.

  8. Click Create to save the alert rule and enable it.

The new alert rule is listed on the Changed Login Location page.

When users log in to CV SRA from a country that is different from their previous login location, an alert is generated.

Configure alert rules for login outside of working hours

Set up alerts that notify administrators when users access CV SRA outside approved working days and times.

Use these rules to enforce security policies and monitor access that occurs outside organizational working hours.

Before you begin

  • Determine the days, times, and timezone for allowed access.

  • Decide which users, roles, or groups will be monitored.

Procedure

  1. On the Alerts page, click Login Outside of Working Hours .

    The Login Outside of Working Hours page displaying the default configuration appears. By default, the severity of the rules is medium.

  2. To modify the default severity:

    1. Click Edit .
    2. In the Edit Configuration panel, set the default severity level of the alert to Critical, High, Medium, or Low, depending on how urgently the alert should be addressed.
    3. Click Save .

  3. To configure an alert rule:

    1. Click Add on the Login Outside of Working Hours page.
    2. In the Configure Alert section, select the scope of users the alert applies to:

      • All users – Default option. Applies the alert to all users.

      • Selected user roles – Apply the alert to users assigned to specific user roles. For example, device operator, SRA users.

      • Selected access control groups – Apply the alert to users in specific access control groups.

    3. In the Configure Rules section, set the time and days when you want to allow users to access CV SRA.

      • Choose the days from the Allowed days of the week drop-down list.

      • Choose the start and end times in the Allowed working hours field.

      • Select a timezone from the Timezone drop-down list.

  4. Click Next .

  5. To set email notifications, specify who should receive email alerts in the Set Notification section:

    • Selected Users – Choose this option to send notifications to specific users.

    • Selected User Roles – Choose this option to notify users assigned to specific roles.

    • Do not send email notification – Select this option if you do not want email notifications to be sent when the alert is triggered.

  6. Click Next .

  7. To enter a rule name and review the details:

    1. On the Review page, enter a rule name in the Alert Rule Name field.
    2. Verify all the configured alert details.
    3. Click Back to navigate to the previous pages and make changes.

  8. Click Create to save the alert rule and enable it.

The new alert rule is listed on the Login Outside of Working Hours page.

When a user logs in to CV SRA outside the time and days configured by you, an alert is generated.

Pause alerts

Temporarily disable alert rules for a selected alert type.

Use this option during maintenance periods or when you do not want alerts triggered for certain activities.

Procedure

  1. Navigate to the Alerts dashboard.

  2. Click Pause against the alert type you want to pause.

All alert rules configured in the alert type will be disabled, and no alerts will be triggered for those rules.

Resume an alert

Reactivate alert rules for a previously paused alert type.

Use this when you are ready to resume normal monitoring and alerting for the selected alert type.

Procedure

  1. Locate the alert that is paused.

  2. Click Resume in the Action column.

Alert rules for the selected alert type are reactivated, and alerts will be triggered according to the configured rules.