Cybersecurity · Intermediate level

Intermediate level · Module 4: Logging and Detecting Suspicious Activity · Lesson 3 of 3

Alerts and Response Routines

Get notified about important events and act on them consistently.

In this lesson you will

  • Configure simple alerts
  • Write a routine for reviewing and acting on alerts

Key concepts

alertsalert fatiguetriagereview routine

The lesson

Alerts bring important events to a person's attention: sign-ins from new countries, MFA changes, new admin accounts, malware detections.

Too many alerts cause alert fatigue; start with a few high-value alerts and tune them.

A weekly review routine checks alerts, failed sign-ins and admin changes, and records what was checked.

Step by step

  1. Choose five high-value alerts.
  2. Configure them in the lab tools.
  3. Test one alert.
  4. Write the weekly review routine.

Practice activity

Set up alerts and a weekly review routine.

Expected result: Working alerts and a documented routine.

Check your understanding

  1. What is alert fatigue?

    Show answer

    So many alerts that important ones are ignored.

  2. Give one high-value alert.

    Show answer

    A new admin account, an MFA change or a sign-in from a new country.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.