Understanding Your Daily/Weekly Incident Alerts
GuardWare automatically sends two types of scheduled alert reports via email to help you stay on top of user activities and potential risks:
User-Based Incident Alerts (Daily/Weekly)
Incident Summary Alerts (Daily/Weekly)
Both reports are interactive; clicking on an item takes you directly to the Dashboard for deeper investigation.
Before opening the links, make sure you’re logged in to the INSIGHT Management Console.
User-based Incident Alerts
User-based Incident Alerts show user-specific incidents and highlight individuals who may be bypassing policies or engaging in risky behaviour. The daily/weekly alerts help you identify issues early and take timely action.
This feature ensures you receive timely, actionable alerts for critical user-specific risks without needing to log in and manually check the dashboard. This makes it easy to see which users are showing risky behaviour, so security teams can take necessary actions on time.
What You Will Receive
Daily/weekly emails containing:
A list of users displaying risky behaviour
Number of users and the type of incident associated with each user
A direct link to view more details in the Dashboard
How to Check Details
These emails are clickable. Clicking any incident takes you directly to the relevant Dashboard.
Example: Clicking “Emailing of attachments from Corporate Email Address to Non-Corporate Email Address” takes you to the Risks Summary > Email Activities widget in the Dashboard.
From here you can:
Click an individual record to see username, date and time, sender and recipient addresses, subject, and file name.
Use the Arrow icon in the Action column to drill down further.
Use the search box at the top to quickly locate specific information.
Similarly, clicking on a username in the alert email takes you to the same widget but filtered for that specific user, allowing you to review all their related activities in detail.
How to Configure
Log in to the GuardWare INSIGHT Management Console.
Click Open Management Console.
Navigate to Audit Report > Manage Report > User Based Incident Alerts.
Click Create a new User-based Risk Email, enter a name for the alert, and choose how often you’d like to receive the alert (daily, weekly, or monthly).
Click Create Risk to define the type of incident you want to track (e.g., file uploads to non-corporate websites, time spent on non-corporate apps). This step sets the foundation for what the alert will monitor.
Select Risk Type, enter a Risk Name and define Risk parameters such as incident thresholds (e.g., number of files, time duration).
Select the User Groups you want to monitor and click Save.
Select the previously created alert name, set a start and end date, and select the risks you want included.
Click Generate a User-based Risk Email now for these dates to verify the configurations and generate a test email. Once the setup is complete, you’ll automatically begin receiving emails at the frequency you selected.
Incident Summary Alerts
Incident Summary Alerts provide a high-level overview of all incident categories across your organisation. You’ll see how many users were involved, how many incidents occurred, and the associated risk levels. This gives you a complete snapshot of your security posture in a single email.
What You Will Receive
Daily/weekly emails summarising:
Incident categories
Number of users involved
Total incidents logged
Risk levels and severity indicators
Direct links to relevant Dashboards
How to Check Details
Just like the user-based alerts, these emails are interactive as well. Clicking any incident takes you directly to the relevant Dashboard.
Example: Clicking “Files Uploaded to Generative AI Websites” takes you to the Risks Summary > Usage of AI Tools widget in the Dashboard. This widget displays instances where corporate files have been uploaded to AI-powered platforms such as ChatGPT or claude.ai.
From here you can:
Click any record to view username, application name, URL, PC name, and violation date and time.
Use the Arrow icon in the Action column for deeper investigation
Use the search box to filter specific information quickly.
How to Configure
Log in to the GuardWare INSIGHT Management Console.
Click Open Management Console.
Navigate to Audit Report > Manage Report > Incident Summary Alerts.
Click Create New Risk Summary Email, enter a name for the alert, and choose how often you’d like to receive the alert (daily, weekly, or monthly).
Click Create Risk Set to define the type of incident you want to track (e.g., file uploads to non-corporate websites, time spent on non-corporate apps). This step sets the foundation for what the alert will monitor.
Select Risk Type, enter a Risk Name and define Risk parameters such as incident thresholds (e.g., number of files, time duration).
Select the User Groups you want to monitor and click Save.
Select the previously created alert name, set a start and end date, and select the risks you want included.
Click Generate a test Risk Summary Email now for these dates to verify the configurations and generate a test email. Once the setup is complete, you’ll automatically begin receiving emails at the frequency you selected.
Last updated