See and work every alert from one page
See every open alert across every client in one list: device alerts, CyberSentry findings and expiring items. Filter by client, severity or time frame, acknowledge one or a hundred at once, and export the filtered list to CSV (up to 10,000 rows).
Domain tabs
All, Devices, CyberSentry and Expirations narrow the one list to a single kind of alert. You only get the tabs your role can open: a tech without CyberSentry never sees that tab or its rows.
Client, Status, Severity, Time frame, Search
Pick a client, a status, a severity or a time frame, or type in the search box, to cut the list down. Status opens on Open, the work still waiting. Switch it to Acknowledged, Closed or All statuses to see the rest. Time frame starts on All time and also offers year to date, this month, last month, the last 7, 30 or 90 days, the last 12 months and a custom From and To.
Alerts table
Each row shows Severity, Domain, Client, Alert, Entity and when it was Raised. On an open row, tick its box and press Acknowledge, or use the Acknowledge link beside Open on the row. The box in the header selects every open alert on the page, and a bar appears with a count and one Acknowledge button for the lot. The download icon above the table exports the filtered list as a CSV file, not just the page on screen, up to 10,000 rows. If the list is longer, you are told, and you can narrow the filters to export the rest.
Browse
On this page
Why it works this way: See and work every alert from one page
Acknowledge means you have seen the alert and are on it. Acknowledged alerts leave the default Open view, and the alert stays live on the page that owns it, which is where it gets closed.
Acknowledge works on up to 100 alerts at a time. If your role cannot change one kind of alert, such as security findings without CyberSentry edit rights, those rows are refused and the rest still go through, with a count of how many were not done.
Severity reads the same across every kind of alert. A device alert keeps its own severity, a CyberSentry high shows as Critical and medium as Warning, and low or informational both show as Info.
An expiration gets its severity from how close it is: expired or within 7 days is Critical, within 30 days is Warning, anything further out is Info.
A closed device alert says how it ended on a second line under its title, for example "Resolved by a technician", "Cleared on its own" or "Device went offline".
If your role cannot see a whole kind of alert and nothing else matches, the empty list names the missing one, for example "Your role does not have access to: CyberSentry", instead of just saying nothing matches.
Time frame measures when an alert was raised, not when it was last seen or expires. It defaults to All time so an old unresolved critical cannot drop out of sight.
Other ways to do this: See and work every alert from one page
Ask Elise about a security alert
In Elise chat, ask "Explain this CyberSentry alert in plain English and tell me the next step" to get what happened, why it matters and what to do. Ask "Triage this high CyberSentry alert" and Elise judges whether it is a real threat or background noise, then keeps it in the human queue or clears it. Ask "How are we doing on SLAs this quarter?" for the ticket side of the same picture.
Questions this page answers
What is the Alerts Desk?
One place to look at every open alert we raise, across every client and every monitored domain. It does not replace the pages where alerts live: device alerts still belong to the device, CyberSentry alerts to Triage, expirations to the client's documentation. The desk is a reading surface over all of them, so a tech has one list to scan instead of four pages to remember.
How is severity decided?
Each domain keeps its own rules and the desk shows them in one vocabulary. Critical, Warning and Info map from the device alert severity, from the CyberSentry alert severity (high reads as critical, low and informational both read as info), and for an expiration from how close it is: expired or within 7 days is critical, within 30 days is a warning, anything further out is info. Severity is the only colour on the page, so a red row always means the same thing.
What do Open, Acknowledged and Closed mean here?
Open means nobody has picked it up. Acknowledged means somebody has, and it is still live. Closed means it is over, however it ended: a device alert that resolved, a security alert that was resolved or expired, or an expiration that has passed and been acknowledged. The desk opens on Open because that is the work; switch the Status filter to Acknowledged, Closed or All to see the rest.
What does the Time frame filter measure?
When the alert was raised, not when it expires or when it was last seen. It defaults to All time on purpose: a six month old critical that nobody fixed is exactly the row this page exists to surface, and a rolling window would hide it. The presets are the same ones the report builder uses, so "Last 30 days" means the same thing in both places.
What do the domain tabs do?
They filter the same list. "All" shows every domain together; Devices shows monitoring alerts from managed computers; CyberSentry shows Microsoft 365 security alerts; Expirations shows licenses, certificates, domains, warranties and contracts that are inside their alert window. You only see the tabs your account has access to: a tech without CyberSentry never receives a security row, on any tab. If "All" comes back with zero rows because a whole domain is missing from your account, the empty message names it, which is different from the list genuinely having nothing open.
What does the RMM Health report show?
One row per client, for the days you pick. It counts their Devices, how many are Offline, their Uptime, their Patch compliance, and their Open alerts. It is a picture of a window of time, not of this minute.
Was this helpful?