Alarms Management

An alarm Alarms provide notification of an event or sequence of events that require attention or investigation. in USM Anywhere consists of one or more events Any traffic or data exchange detected by AT&T Cybersecurity products through a sensor or external devices such as a firewall., based on one of the following:

Note: USM Anywhere stores 10 of the events which have generated the alarm, for 365 days. If the alarm was generated by more than 10 events, USM Anywhere stores the first and the last 9 events.
Alarms themselves are stored for 365 days.

USM Anywhere enables you to drive actions In USM Anywhere you can execute an action from alarms, events, and vulnerabilities to run a scan, get forensic information, or execute a response for a configured AlienApp. in response to incoming alarms. Perhaps the most common action is sending an email to administrators to provide real-time notification Communication of an important event, typically through an email message or other desktop display. In USM Appliance, notifications are typically triggered by events, policies, and correlation directives, and in USM Anywhere, they are typically triggered by notification rules or directly from alarms. of a critical security incident. Each user can decide if they want to receive alarm notifications. See Managing Your Profile Settings for more information.

Note: You can watch the Conducting Security Analysis with AT&T Cybersecurity USM Anywhere customer training webcast on-demand to learn how to leverage USM Anywhere to perform security analyst duties.

This topic discusses these subtopics: