Alert

An alert is a notification generated by a security tool, such as an EDR, SIEM, or firewall, indicating that a potentially suspicious or malicious event has occurred. Alerts are the primary input for SOC analysts. Most organizations receive hundreds or thousands of alerts per day, the vast majority of which turn out to be false positives or benign activity. Managing alert volume without missing real threats is one of the central challenges of modern security operations.