> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/alerting/which-specific-alerts-can-i-define-in-enginsight.md).

# Which specific alerts can I define in Enginsight?

Alerts are a key component of the Enginsight platform. They allow you to be notified when a security-relevant event (issue or incident) occurs in your IT infrastructure.

{% hint style="success" icon="lightbulb-exclamation" %}
For more information on how to create an alert in the Enginsight platform, see the Enginsight Manual: [Add Alert](https://docs.enginsight.com/docs/manual/english/platform-usage/alerts/overview/add-alert)
{% endhint %}

***

## Alert Types

You can define specific alerts for the following Enginsight components:

* [Host](#host): A server or client on which the Enginsight agent Pulsar is running.
* [Endpoint](#endpoint): A website or domain monitored by the Enginsight component Observer.
* [Observation](#observation): Configured SNMP, ping, or port monitoring performed by the Enginsight component Watchdog.
* [Watchdog](#watchdog): Detection of network devices by the Enginsight component Watchdog.
* [Workflow (SIEM)](#workflow-siem): Detection of new SIEM incidents by a custom workflow.
* [Tracer (SIEM)](#tracer-siem): Detection of a deviation from a defined normal state using AI-based time-series analysis.
* [Stream (SIEM)](#stream-siem): Detection of new SIEM incidents by a stream.
* [Stream Catalog (SIEM)](#stream-catalog-siem): Detection of new SIEM incidents by streams included in a stream catalog.

***

## Available Alert Conditions by Alert Type

Depending on the alert type you select, different conditions are available that can trigger an alert.

{% tabs %}
{% tab title="Host" %}

### Services and Processes

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Specific system-relevant service is executed</td><td><p>Triggers an alert as soon as a selected system-relevant service has been started.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: The service must first have been marked as system-relevant in the settings of the corresponding host under <strong>Monitoring</strong> → <a href="https://docs.enginsight.com/docs/manual/english/platform-usage/host-detail-view/monitoring/services">Services</a>.</p></div><p><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Specific system-relevant service is executed</strong> to open a new window that lists all available system-relevant services.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Select a service from the list and click <strong>Select</strong>.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Select Service</strong> to add another service.</p></td></tr><tr><td>Specific system-relevant service is not executed</td><td><p>Triggers an alert as soon as a selected system-relevant service has stopped running.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: The service must first have been marked as system-relevant in the settings of the corresponding host under <strong>Monitoring</strong> → <a href="https://docs.enginsight.com/docs/manual/english/platform-usage/host-detail-view/monitoring/services">Services</a>.</p></div><p><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Specific system-relevant service is not executed</strong> to open a new window that lists all available system-relevant services.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Select a service from the list and click <strong>Select</strong>.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Select Service</strong> to add another service.</p></td></tr><tr><td>System-relevant services are not executed</td><td><p>Triggers an alert as soon as any system-relevant service has been stopped.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: The services must first have been marked as system-relevant in the settings of the corresponding host under <strong>Monitoring</strong> → <a href="https://docs.enginsight.com/docs/manual/english/platform-usage/host-detail-view/monitoring/services">Services</a>.</p></div></td></tr><tr><td>Process is executed</td><td><p>Triggers an alert as soon as a selected process has been started.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Process is executed</strong> to open a new window that lists all available processes.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Select a process from the list and click <strong>Select</strong>.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Select Process</strong> to add another process.</p></td></tr><tr><td>Process is not executed</td><td><p>Triggers an alert as soon as a selected process has been stopped.</p><p><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Process is not executed</strong> to open a new window that lists all available processes.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Select a process from the list and click <strong>Select</strong>.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Select Process</strong> to add another process.</p></td></tr></tbody></table>

### Events

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Logon attempt of a non existent user</td><td>Triggers an alert as soon as a login attempt is made by a user (username or user ID) that does not exist in the system.</td></tr><tr><td>An account was reenabled (only Windows)</td><td>Triggers an alert as soon as a user account has been enabled again (Windows Event 4722).</td></tr><tr><td>An admin account was reenabled (only Windows)</td><td>Triggers an alert as soon as an administrator user account has been enabled again (Windows Events 4722, 4732, 4728).</td></tr><tr><td>A user has gotten more privileges (only Windows)</td><td>Triggers an alert as soon as a user has received additional permissions (Windows Events 4732, 4728).</td></tr><tr><td>Successful login attempt</td><td>Triggers an alert as soon as a user has successfully logged in to a system (Windows Event 4624).<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Successful login attempt</strong> to show additional fields.<br><br>Use the options <strong>Period considered from</strong>, <strong>Period considered to</strong>, <strong>Time zone</strong>, <strong>Number of allowed logins per user</strong>, and <strong>Interval of viewing in minutes</strong> to define more precisely during which period and at how many successful logins per interval in minutes an alert should be triggered.</td></tr><tr><td>Failed login attempt</td><td>Triggers an alert as soon as a user was unable to log in to a system successfully (Windows Event 4625).<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Failed login attempt</strong> to show additional fields.<br><br>Use the options <strong>Period considered from</strong>, <strong>Period considered to</strong>, <strong>Time zone</strong>, <strong>Number of allowed logins per user</strong>, and <strong>Interval of viewing in minutes</strong> to define more precisely during which period and at how many failed logins per interval in minutes an alert should be triggered.</td></tr><tr><td>New admin account created (only Windows)</td><td>Triggers an alert as soon as a new user has been created (Windows Event 4720).</td></tr><tr><td>New user account created (only Windows)</td><td>Triggers an alert as soon as a new administrator has been created (Windows Events 4720, 4732, 4728).</td></tr></tbody></table>

### Hard Disks

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Hard disk (used %)</td><td>Triggers an alert as soon as n% of storage space is used on all disks or on a specific disk.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Hard disk (used %)</strong> to show additional fields.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click in the <strong>Hard disks</strong> field to expand a submenu where you can select all disks or a specific disk.<br><br>Use the fields <strong>Aggregator</strong>, <strong>Interval (Minutes)</strong>, <strong>Operator</strong>, and <strong>Threshold (%)</strong> to define more precisely at which storage usage level an alert should be triggered.</td></tr><tr><td>Hard disk (available %)</td><td>Triggers an alert as soon as only n% of storage space is available on all disks or on a specific disk.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Hard disk (available %)</strong> to show additional fields.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click in the <strong>Disks</strong> field to expand a submenu where you can select all disks or a specific disk.<br><br>Use the fields <strong>Aggregator</strong>, <strong>Interval (Minutes)</strong>, <strong>Operator</strong>, and <strong>Threshold (%)</strong> to define more precisely at which storage availability level an alert should be triggered.</td></tr><tr><td>Disk will be removed</td><td>Triggers an alert as soon as a disk is removed.</td></tr><tr><td>New disk will be detected</td><td>Triggers an alert as soon as a new disk is detected.</td></tr></tbody></table>

### Machine Learning

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Unusual behavior</td><td><p>Triggers an alert as soon as a monitored host metric is outside the calculated normal state.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Unusual behavior</strong> to show another field.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click in the <strong>Anomaly severity</strong> field to expand a submenu where you can define the criticality of the anomaly.<br></p><p>The following severity levels are available:</p><ul><li><strong>OK</strong>: The alert is for information only.</li><li><strong>Low</strong>: The anomaly has low criticality.</li><li><strong>Medium</strong>: The anomaly has medium criticality.</li><li><strong>High</strong>: The anomaly has high criticality.</li><li><strong>Critical</strong>: The anomaly has very high criticality.</li></ul></td></tr></tbody></table>

### Metrics

<i class="fa-computer-mouse">:computer-mouse:</i> Select one of the conditions under **Metrics** to show additional fields.

Use the fields **Aggregator**, **Interval (Minutes)**, **Operator**, and **Threshold (%)** to define more precisely when an alert should be triggered.

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>CPU user</td><td>Triggers an alert as soon as the CPU load required by users exceeds a specific threshold.</td></tr><tr><td>CPU IO wait</td><td>Triggers an alert as soon as the share of load the CPU requires to wait for incoming and outgoing operations exceeds a specific threshold.</td></tr><tr><td>CPU steal</td><td>Triggers an alert as soon as the share of load a virtual CPU requires to wait for the host CPU exceeds a specific threshold.</td></tr><tr><td>CPU total</td><td>Triggers an alert as soon as the total CPU load exceeds a specific threshold.</td></tr><tr><td>Host temperature (All sensors)</td><td>Triggers an alert as soon as the host temperature exceeds a specific threshold.</td></tr><tr><td>Network traffic per second (outbound)</td><td>Triggers an alert as soon as outgoing network traffic per second exceeds a specific threshold.</td></tr><tr><td>Network traffic per second (inbound)</td><td>Triggers an alert as soon as incoming network traffic per second exceeds a specific threshold.</td></tr><tr><td>RAM (available %)</td><td>Triggers an alert as soon as only n% RAM is available.</td></tr><tr><td>RAM (available MB)</td><td>Triggers an alert as soon as n MB RAM is used.</td></tr><tr><td>RAM (used %)</td><td>Triggers an alert as soon as n% RAM is used.</td></tr><tr><td>SWAP (available %)</td><td>Triggers an alert as soon as only n% SWAP memory is available.</td></tr><tr><td>SWAP (available MB)</td><td>Triggers an alert as soon as n MB SWAP memory is used.</td></tr><tr><td>SWAP (used %)</td><td>Triggers an alert as soon as n% SWAP memory is used.</td></tr></tbody></table>

### Network Analysis

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Blocked network attack (Shield)</td><td>Triggers an alert as soon as the Intrusion Prevention System (IPS) has blocked an incoming network attack.</td></tr><tr><td>Suspicious network traffic</td><td><p>Triggers an alert as soon as the Intrusion Detection System (IDS) detects a possible network attack.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Suspicious network traffic</strong> to display another field.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click in the <strong>Severity</strong> field to expand a submenu where you can define the criticality of the incident.</p><p></p><p>The following severity levels are available:</p><ul><li><strong>Informational</strong>: The alert is for information only.</li><li><strong>Low</strong>: The incident has low criticality.</li><li><strong>Medium</strong>: The incident has medium criticality.</li><li><strong>High</strong>: The incident has high criticality.</li><li><strong>Critical</strong>: The incident has very high criticality.</li></ul></td></tr></tbody></table>

### Plugins

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Failed plugin</td><td>Triggers an alert as soon as a plugin is not working properly or is not interacting correctly with a host application.</td></tr></tbody></table>

### Software

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Installed/Uninstalled Software</td><td>Triggers an alert as soon as any software is installed on or removed from a host.</td></tr><tr><td>Software is installed</td><td><p>Triggers an alert as soon as specific software has been installed on a host.</p><p></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Software is installed</strong> to open a new window that lists all available software applications.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select a software application from the list and click <strong>Select</strong>.</p><p></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Select Software</strong> to add another software application.</p></td></tr><tr><td>Software is not installed</td><td><p>Triggers an alert as soon as specific software has not been installed on a host.</p><p></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Software is not installed</strong> to open a new window that lists all available software applications.</p><p><br><i class="fa-computer-mouse">:computer-mouse:</i> Select a software application from the list and click <strong>Select</strong>.</p><p></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Select Software</strong> to add another software application.</p></td></tr></tbody></table>

### Scenario

<table><thead><tr><th width="236.81640625">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Group policy change</td><td>Triggers an alert as soon as a change is made to the group policies of a system.</td></tr><tr><td>Host reboot</td><td>Triggers an alert as soon as a host is restarted.</td></tr><tr><td>Host unavailable</td><td>Triggers an alert as soon as a host is unreachable for a specific period of time.</td></tr><tr><td>Host reboot required</td><td>Triggers an alert as soon as a host restart is required.</td></tr><tr><td>New Autostart</td><td>Triggers an alert as soon as a new autostart is performed on a host.</td></tr><tr><td>New open port (TCP)</td><td>Triggers an alert as soon as an open port is detected on a host.</td></tr><tr><td>New vulnerabilities</td><td>Triggers an alert as soon as a new vulnerability (CVE) is detected on a host.</td></tr><tr><td>New vulnerabilities (CVSS score)</td><td>Triggers an alert as soon as the CVSS score of a vulnerability on a host matches a defined value.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>New vulnerabilities (CVSS score)</strong> to show additional fields.<br><br>Use the fields <strong>Operator</strong> and <strong>Threshold</strong> to define more precisely at which CVSS score an alert should be triggered.</td></tr><tr><td>New security updates available</td><td>Triggers an alert as soon as new security updates are available for a host.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>New security updates available</strong> to show another field.<br><br>Enter a numeric value in the field <strong>Update available since (Days)</strong> to define more precisely when the alert should be triggered.</td></tr><tr><td>New patches available</td><td>Triggers an alert as soon as new updates are available for a host.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>New patches available</strong> to show another field.<br><br>Enter a numeric value in the field <strong>Update available since (Days)</strong> to define more precisely when the alert should be triggered.</td></tr><tr><td>Object access outside business hours</td><td>Triggers an alert as soon as an object is accessed on a host outside the defined business hours.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Object access outside business hours</strong> to display additional fields.<br><br>Use the fields <strong>Business hours from</strong>, <strong>Business hours to</strong>, and <strong>Time zone</strong> to define more precisely during which period an alert should be triggered.</td></tr><tr><td>Port unavailable (TCP)</td><td>Triggers an alert as soon as access to a specific port on a host is not possible for TCP communication.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Port unavailable (TCP)</strong> to show additional fields.<br><br>Enter one or more port numbers as a comma-separated list in the <strong>Port</strong> field to define more precisely for which ports the alert should be triggered.</td></tr><tr><td>File Integrity Monitoring</td><td><p>Triggers an alert as soon as changes are detected in monitored folders or files on a host.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>File Integrity Monitoring</strong> to show additional fields.<br><br>Use the options <strong>Period considered from</strong>, <strong>Period considered to</strong>, <strong>Time zone</strong>, <strong>Interval (Minutes)</strong>, and <strong>Minimum number of file accesses to trigger the alert</strong> to define more precisely during which period and at how many file accesses per interval in minutes an alert should be triggered.<br></p><p><i class="fa-computer-mouse">:computer-mouse:</i> Click in the <strong>Severity</strong> field to expand a submenu where you can define the criticality of the incident.</p><p></p><p>The following severity levels are available:</p><ul><li><strong>Informational</strong>: The alert is for information only.</li><li><strong>Low</strong>: The incident has low criticality.</li><li><strong>Medium</strong>: The incident has medium criticality.</li><li><strong>High</strong>: The incident has high criticality.</li><li><strong>Critical</strong>: The incident has very high criticality.</li></ul><p><br><i class="fa-computer-mouse">:computer-mouse:</i> Enable the checkbox <i class="fa-square">:square:</i> next to <strong>Only consider failed events</strong> to define the alert only for object accesses that fail in some way.</p></td></tr><tr><td>Unauthorized object access</td><td>Triggers an alert as soon as an object or resource is accessed on a host without the required permission.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Unauthorized object access</strong> to show another field.<br><br>Enter one or more usernames as a comma-separated list in the field <strong>Authorized users (Down-Level Logon Name)</strong> to define more precisely which object accesses are performed by authorized users and should therefore be excluded from the alert.</td></tr></tbody></table>
{% endtab %}

{% tab title="Endpoint" %}

### DNS

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Invalid CAA DNS record</td><td>Triggers an alert as soon as an incorrect or non-compliant CAA DNS record is detected.</td></tr><tr><td>Invalid SPF DNS record</td><td>Triggers an alert as soon as an SPF DNS record does not comply with the intended standards.</td></tr></tbody></table>

### Events

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Data protection</td><td>Triggers an alert as soon as the SSL/TLS configuration on an endpoint does not comply with BSI requirements.</td></tr><tr><td>DNS record changed</td><td>Triggers an alert as soon as entries in the Domain Name System (DNS) have been changed.</td></tr><tr><td>Endpoint rating got worse</td><td>Triggers an alert as soon as the rating of an endpoint decreases, for example due to the detection of potential new vulnerabilities.</td></tr><tr><td>New open port</td><td>Triggers an alert as soon as an endpoint opens a new port.</td></tr><tr><td>New vulnerability</td><td>Triggers an alert as soon as a new vulnerability (CVE) is identified on an endpoint.</td></tr><tr><td>Failed redirect</td><td>Triggers an alert as soon as an endpoint redirects to an unexpected destination.</td></tr><tr><td>Connection refused</td><td>Triggers an alert as soon as a request from outside the system is blocked.</td></tr><tr><td>Website  not available</td><td>Triggers an alert as soon as an endpoint cannot be loaded or accessed.</td></tr></tbody></table>

### Metrics

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Response time</td><td>Triggers an alert as soon as the response time of an endpoint exceeds a specific threshold.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Response time</strong> to show additional fields.<br><br>Use the options <strong>Aggregator</strong>, <strong>Interval (Minutes)</strong>, <strong>Operator</strong>, and <strong>Threshold (%)</strong> to define more precisely at which response time an alert should be triggered.</td></tr></tbody></table>

### Certificate

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Days until expire date of certificate</td><td>Triggers an alert as soon as the expiration date of an SSL/TLS certificate crosses a specific threshold.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Days until expire date of certificate</strong> to show additional fields.<br><br>Use the options <strong>Operator</strong> and <strong>Threshold</strong> to define more precisely at which time span until certificate expiration an alert should be triggered.</td></tr></tbody></table>
{% endtab %}

{% tab title="Observation" %}

### SNMP Monitoring

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Observations (SNMP) not available</td><td>Triggers an alert as soon as monitoring results cannot be retrieved or obtained via SNMP.</td></tr><tr><td>Unexpected SNMP status</td><td>Triggers an alert as soon as the status of a device retrieved via SNMP does not match the specified or expected value.</td></tr></tbody></table>

### Ping Monitoring

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Ping (Host unavailable)</td><td>Triggers an alert as soon as a host or endpoint is unreachable via ping.</td></tr><tr><td>Ping (Round Trip Time)</td><td>Triggers an alert as soon as the round-trip time for a ping exceeds a specific threshold.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Ping (Round Trip Time)</strong> to show additional fields.<br><br>Use the options <strong>Aggregator</strong>, <strong>Interval (Minutes)</strong>, <strong>Operator</strong>, and <strong>Threshold (%)</strong> to define more precisely at which round-trip time an alert should be triggered.</td></tr></tbody></table>

### Port Monitoring

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Ports not available</td><td>Triggers an alert as soon as a port of a host or endpoint is unreachable.</td></tr></tbody></table>
{% endtab %}

{% tab title="Watchdog" %}

### Events

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>New device detected</td><td>Triggers an alert as soon as the Enginsight component Watchdog discovers a previously unknown device in the network.</td></tr></tbody></table>
{% endtab %}

{% tab title="Workflow (SIEM)" %}

### Scenario

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>New SIEM incident</td><td>Triggers an alert as soon as a new incident is detected in the Enginsight SIEM by a custom workflow.</td></tr></tbody></table>
{% endtab %}

{% tab title="Tracer (SIEM)" %}

### Scenario

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>Monitoring anomalies in the SIEM</td><td><p>Triggers an alert as soon as a deviation from a defined normal state is detected in the Enginsight SIEM by AI-based time-series analysis.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Select the condition <strong>Monitoring anomalies in the SIEM</strong> to show another field.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click in the <strong>Severity</strong> field to expand a submenu where you can define the severity of the anomaly.</p><p></p><p>The following severity levels are available:</p><ul><li><strong>Informational</strong>: The alert is for information only.</li><li><strong>Low</strong>: The anomaly has low criticality.</li><li><strong>Medium</strong>: The anomaly has medium criticality.</li><li><strong>High</strong>: The anomaly has high criticality.</li><li><strong>Critical</strong>: The anomaly has very high criticality.</li></ul></td></tr></tbody></table>
{% endtab %}

{% tab title="Stream (SIEM)" %}

### Scenario

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>New SIEM stream incident</td><td><p>Triggers an alert as soon as a new incident is detected in the Enginsight SIEM by a stream.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: For this alert to take effect, you must first <a href="https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/streams/add-stream#tab-incident-detection">enable incident detection</a> for the corresponding stream.</p></div></td></tr></tbody></table>
{% endtab %}

{% tab title="Stream catalog (SIEM)" %}

### Scenario

<table><thead><tr><th width="199.71484375">Alert condition</th><th>Description</th></tr></thead><tbody><tr><td>New SIEM catalog incident</td><td><p>Triggers an alert as soon as a new incident is detected in the Enginsight SIEM by streams included in a specific stream catalog.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: For this alert to take effect, you must first <a href="https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/streams/add-stream#tab-incident-detection">enable incident detection</a> for the corresponding stream catalog.</p></div></td></tr></tbody></table>
{% endtab %}
{% endtabs %}

***