> For the complete documentation index, see [llms.txt](https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/core-features/spectra-ai/playbooks/policy-and-alerts/levels-of-actions-on-alerts.md). # Levels of Actions on Alerts Actions can be performed at four different levels, providing flexibility in alert management:
[#id-1.-individual-sub-alert-actions](#id-1.-individual-sub-alert-actions "mention") ├ [#i-resolving-sub-alerts](#i-resolving-sub-alerts "mention") ├ [#ii-reassigning-sub-alerts](#ii-reassigning-sub-alerts "mention") ├ [#iii-adding-sub-alerts-to-no-scan-list](#iii-adding-sub-alerts-to-no-scan-list "mention") ├ [#iv-adding-sub-alerts-to-permit-list](#iv-adding-sub-alerts-to-permit-list "mention") └[#v-muting-sub-alerts](#v-muting-sub-alerts "mention")\ \ [#id-2.-batch-sub-alert-actions](#id-2.-batch-sub-alert-actions "mention") [#id-3.-multiple-alert-level-actions](#id-3.-multiple-alert-level-actions "mention") [#id-4.-alert-level-actions](#id-4.-alert-level-actions "mention") *** ### 1. Individual Sub Alert Actions Actions are taken on individual sub alerts, allowing you to resolve, reassign, add to permit list, or perform other actions on specific objects within an alert. This level of control is particularly useful when you need to handle each impacted object differently based on its content, sensitivity, or other factors. #### i) Resolving Sub Alerts 1. Select the checkbox next to the sub alert(s) you want to act on.
2. Select 'Resolve' from the Actions dropdown menu.

Figure 36: Resolve Sub Alerts

3. In the Resolve window, add a note to provide context or document the actions taken offline.

Figure 36.1: Resolve Sub Alerts

4. Click 'Resolve' to mark the sub alert(s) as resolved.

Figure 36.2 Resolve Sub Alerts

**Impact on Table View:** After resolving a sub alert, it will be removed from the '**Objects Impacted'** table, as it has been marked as resolved.

Figure 36.3 Resolve Sub Alerts

**Impact on Dashboard View:** The alert dashboard will update to reflect the decreased number of objects impacted, entities impacted, and attributes associated with the resolved sub alert(s).

Figure 36.4 Resolve Sub Alerts

#### ii) Reassigning Sub Alerts 1. Select 'Reassign' from the Actions dropdown menu.

Figure 37: Reassign Sub Alerts

2. In the Reassign window, enter the email address of the user you want to reassign the sub alert(s) to.

Figure 37.1: Reassign Sub Alerts

2. Click '**Assign**' to complete the reassignment.

Figure 37.2: Reassign Sub Alerts

**Impact on Table View:** After reassigning a sub alert, the '**`Assignee`**' column in the '**Objects Impacted**' table will update to display the email address of the new assignee for the corresponding sub alert(s).

Figure 37.3: Reassign Sub Alerts

**Impact on Dashboard View:** The total number of assignees in the alert dashboard will increment to reflect the additional assignee(s) for the reassigned sub alert(s) #### iii) Adding Sub Alerts to No Scan List 1. Select '**`Add to "No Scan List"`**' from the **Actions** dropdown menu.

Figure 38: Add Sub Alerts to No Scan List

2. In the Add to No Scan List window, you can choose to add a note if necessary and then click on **Add to no-scan list**.

Figure 38.1: Add Sub Alerts to No Scan List

Figure 38.2: Add Sub Alerts to No Scan List

**Impact on Table View:** After adding a sub alert to the no scan list, it will be removed from the 'Objects Impacted' table, as it will no longer be scanned by the data source.

Figure 38.3: Add Sub Alerts to No Scan List

**Impact on Dashboard View:** The alert dashboard will update to reflect the decreased number of objects impacted, entities impacted, and attributes associated with the sub alert(s) added to the no scan list.

Figure 38.4: Add Sub Alerts to No Scan List

#### iv) Adding Sub Alerts to Permit List 1. Select '**Add to Permit List**' from the Actions dropdown menu.

Figure 39: Add Sub Alerts to Permit List

2. In the Add to Permit List window, you can choose to add a note to provide additional information.


Figure 39.1: Add Sub Alerts to Permit List

3. Click '**Add to Permit List**' to complete the action.

Figure 39.2: Add Sub Alerts to Permit List

**Impact on Table View:** After adding a sub alert to the permit list, it will be removed from the 'Objects Impacted' table, as it has been exempted from the policy rules.

Figure 39.3: Add Sub Alerts to Permit List

**Impact on Dashboard View:** The alert dashboard will update to reflect the decreased number of objects impacted, entities impacted, and attributes associated with the sub alert(s) added to the permit list.

Figure 39.4: Add Sub Alerts to Permit List

#### v) Muting Sub Alerts 1. Select '**Mute Alert**' from the **Actions** dropdown menu.

Figure 40: Mute Sub Alerts

2. In the Mute Alert window, set the mute duration by selecting the number of days, weeks, or months from the dropdown menu.
3. Add a note to provide additional information.

Figure 40.1: Mute Sub Alerts

4. Click '**Mute Alert**' to temporarily suppress the sub alert(s) for the specified duration.

Figure 40.2: Mute Sub Alerts

**Impact on Table View:** After muting a sub alert, it will be removed from the 'Objects Impacted' table for the specified mute duration and added to the '**Permit List'** table within Playbooks.

Figure 40.3: Mute Sub Alerts

**Impact on Dashboard View:** The alert dashboard will update to reflect the decreased number of objects impacted, entities impacted, and attributes associated with the muted sub alert(s) for the duration of the mute period.

Figure 40.4: Mute Sub Alerts

*** ### 2. Batch Sub Alert Actions Alerts 2.0 allows users to perform batch actions on sub alerts, streamlining alert management. You can select all sub alerts on a page at a time by checking the boxes next to each relevant row in the 'Objects Impacted' table. This feature enables you to efficiently apply the same action to multiple sub alerts simultaneously, saving time and effort.

Figure 41. Batch Actions on Sub Alerts

*** ### 3. Multiple Alert-level Actions The multiple alert level allows you to perform actions on sub alerts across multiple alerts simultaneously. This means that you can select different alerts from a single list-view and perform an action on them at once. To perform a multiple alert-level action, follow these steps: 1. Navigate to the **Alerts** page, which displays a list view of all the alerts. 2. Select the checkboxes next to the alerts you want to perform the action on. You can select alerts from different policies or rule sets. 3. Once you have selected the desired alerts, click on the action button (**Reassign**, **Resolve**, or **Mute**).

Figure 42. Multi-alert-level Actions

*** ### 4. Alert-level Actions Actions at this level affect all sub alerts within a single alert. When you perform an action at the alert level, it is applied to every object impacted by the alert. This is useful when you want to apply the same action to all sub alerts within an alert, such as reassigning the entire alert to a different user or adding all impacted objects to the permit list. Users can further perform actions on the alerts by ticking the checkbox for the alert under **Alert name**. To perform an alert-level action, follow these steps: 1. On the alert details page, locate the action buttons in the top-left corner of the screen. 2. Click on the desired action button (**Reassign**, **Resolve**, or click on the :arrow\_down\_small: arrow to **Mute**) to apply the action to all sub alerts within the alert.

Figure 43. Alert-level Action on Sub Alerts

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.lightbeam.ai/lxqobxw6ak7CTnsQjikH/core-features/spectra-ai/playbooks/policy-and-alerts/levels-of-actions-on-alerts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.