Skip to content

Configuring Alert Rules

Alert rules in LT Auditor MP are configured as audit filters in the Manage module with an Alert action applied. When an incoming event matches the filter’s conditions, LT Auditor MP generates an alert and notifies the configured recipients. This article covers how to configure filters specifically for alerting purposes and provides recommended starting alert rules for common security scenarios.

Understanding alert rules:

Alert rules are a specific application of audit filters. Rather than simply retaining or discarding events, an alert filter generates a notification when matching events arrive. The same filter can combine multiple actions — for example, both retaining an event in the database and generating an alert simultaneously.

Alert filters are configured per environment and category, meaning you navigate to the relevant environment and category in the Manage module before creating the alert rule.

Accessing alert filter configuration:

  1. Log in to the LT Auditor MP web portal
  2. Navigate to Manage in the main navigation menu
  3. Select the Environment the alert applies to
  4. Select the Category card for the relevant log category
  5. Click Add Filter to create a new alert rule

Creating an alert rule:

  1. Navigate to Manage and select the relevant environment and category
  2. Click Add Filter
  3. Configure the filter details:
    • Filter Name — use a naming convention that clearly identifies this as an alert (e.g., Alert — Failed Login Threshold Exceeded)
    • Description — the purpose of the alert and what it monitors
    • Priority — the evaluation order relative to other filters
    • Active Status — set to enabled
  4. Under the Conditions tab define what the alert monitors:
    • Click Add Condition
    • Select the relevant field from the log schema
    • Choose an operator (Equals, Contains, Greater Than, etc.)
    • Enter the comparison value
    • Add additional conditions using AND/OR logic as needed
  5. Under the Operations tab select which event types trigger the alert
  6. Under the Actions tab:
    • Select Alert
    • Configure alert-specific parameters:
Parameter Description
Severity Critical, High, Medium, or Low
Email Recipients Who receives the alert notification
Alert Frequency Immediate, Daily digest, or threshold-based
  1. Optionally add a Retain action alongside Alert so the matching event is also stored in the database
  2. Click Test Filter to confirm the rule matches the intended events before activating
  3. Click Save and confirm the filter is set to Active

Recommended alert rules:

The following alert rules represent a recommended starting set for security monitoring. Your administrator should review and expand this list based on your organization’s specific requirements.

Critical priority:

Alert Name Condition Environment / Category
Failed Login Threshold Exceeded Failed logon count exceeds threshold in time window Windows / Authentication
Privileged Account Change Member added to privileged group Windows / Active Directory
New Administrator Account Created New account added to admin group Windows / Active Directory
Global Administrator Role Assigned Role = Global Administrator assigned Azure / Entra ID Audit Logs
Conditional Access Policy Deleted Operation = Delete conditional access policy Azure / Entra ID Audit Logs
Risky Sign-In — High Risk Risk Level = High Azure / Risky Sign-Ins
PHI Found in Unexpected Location PII Class Type = PHI AND Path NOT IN approved locations PII Scanner / Scan Results

High priority:

Alert Name Condition Environment / Category
Account Lockout Event ID = 4740 Windows / Security
File Deletion on Sensitive Path Operation = Delete AND Path STARTS WITH sensitive path Windows / File Activity
New Guest Account Created Operation = Invite external user Azure / Entra ID Audit Logs
MFA Disabled for User Operation = Update user AND MFA = Disabled Azure / Entra ID Audit Logs
NSS File Permission Change Operation = Permission Change eDirectory / NSS File Activity

Medium priority:

Alert Name Condition Environment / Category
Sign-In from Unfamiliar Location Location NOT IN approved countries Azure / Sign-In Logs
Sign-In Outside Business Hours Status = Success AND Timestamp outside business hours Azure / Sign-In Logs
Large PII Finding Volume PII match count exceeds threshold in single scan PII Scanner / Scan Results
eDirectory Object Modified Operation = Object Modified OpenText / eDirectory

Managing alert rules:

Reviewing active alerts:

  1. Navigate to Alerts → Active Alerts in the Web UI
  2. Review each open alert and take appropriate action
  3. Resolve alerts once investigated and documented

Editing an alert rule:

Requires updateFilter permission.

  1. Navigate to Manage and select the relevant environment and category
  2. Locate the alert filter
  3. Click the Edit icon
  4. Modify conditions, operations, or alert parameters as needed
  5. Click Save

Enabling and disabling alert rules:

  1. Locate the alert filter in the Manage module
  2. Toggle the Active switch
  3. Inactive alert rules are not evaluated against incoming events

Deleting an alert rule:

Requires deleteFilter permission. Consider disabling rather than deleting alert rules — deleted filters cannot be recovered.

  1. Select the alert filter
  2. Click the Delete icon
  3. Confirm the deletion

Best practices:

  • Always test alert rules using Test Filter before activating them in production to confirm they match the intended events
  • Use clear descriptive names that identify both the alert type and the environment it monitors
  • Set Immediate delivery for Critical alerts so your security team is notified without delay
  • Use threshold-based alert frequency for high-volume event types like failed logons to avoid alert fatigue
  • Combine the Alert action with the Retain action so matching events are both stored and flagged
  • Review and tune alert rules regularly — normal activity patterns in your environment will change over time
  • Document all active alert rules and their intended purpose so the configuration is auditable
  • Set priorities carefully relative to other filters in the same category — filter evaluation order matters

[Your administrator should establish a regular review cycle for active alert rules — at minimum quarterly — to confirm they remain relevant and appropriately tuned for your environment.]