> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/alerts/how-alerts-work.md).

# How Alerts Work

Alerts isn't one feed pulling from one place — it's nine alert umbrellas, each sourced differently, that all land in the same Alerts tab. See [Monitored Alerts](/modules/secure/alerts/monitored-alerts.md) for the full alert catalog.

| Umbrella                           | Source                                                                          |
| ---------------------------------- | ------------------------------------------------------------------------------- |
| M365 Monitored Alerts              | Microsoft 365 Unified Audit Log                                                 |
| M365 Defender (Incidents & Alerts) | Microsoft Defender / Cloud App Security / Microsoft Sentinel incidents & alerts |
| Purview Alerts (UAL)               | Unified Audit Log, sign-in risk category                                        |
| M365 Risk Detections               | Microsoft Entra ID Protection                                                   |
| Posture Drift Alerts               | Augmentt's own daily security posture regression check                          |
| Directory Audit Alerts             | Unified Audit Log, directory-audit category                                     |
| UAL Mailbox Rule Alerts            | Unified Audit Log, mailbox-rule category                                        |
| Scheduled Action Alerts            | Augmentt's own scheduled actions                                                |
| Dedicated Posture Alerts           | Augmentt's own daily security posture regression check                          |

Posture Drift Alerts and Dedicated Posture Alerts work differently from the other seven umbrellas: instead of reacting to an event, Augmentt checks each client's security posture once a day and alerts you only when a policy that used to be compliant no longer is — a regression, not a one-time snapshot. Every other umbrella above is event- and signal-based: it fires when something actually happens (a sign-in, an audit log entry, a Defender detection, a directory change, a scheduled action completing).

For exactly how often each umbrella is scanned, and why you might occasionally see what looks like the same alert twice, see the [Alerts section of the FAQ](/frequently-asked-questions.md#alerts).

## Getting notified

Generating an alert and notifying you about it are two separate steps. Every alert lands in the Alerts feed regardless of your settings; whether it also emails you, opens a PSA ticket, or fires a webhook — and on what schedule — is controlled entirely from [Enable Alert Notifications](/modules/secure/alerts/enable-alert-notifications.md).

## Snoozing and muting alerts

If a specific alert doesn't need to keep notifying you — a known false positive, a maintenance window, a client that's already aware and working the issue — you can snooze it without turning off the alert type entirely.

**To snooze an alert:**

1. From the Alerts list, find the row for the alert you want to quiet, open its row action menu, and select **Snooze alert**.
2. In the Snooze alert dialog, choose:
   * **Alert(s)** — one or more specific alert types to snooze (multi-select).
   * **Users** — leave this blank to snooze the alert for everyone at the company, or pick specific users to snooze it only for them.
   * **Duration** — **Indefinite** (stays snoozed until you turn it back off) or a **time-bound** date range if you only need it quiet temporarily.
3. Save. The alert stops notifying immediately for whatever combination of alert type, user(s), and company you selected.

To bring notifications back, open the same row's menu and select **Unsnooze alert**, or manage it from the **Rules** tab (below).

{% hint style="info" %}
Snoozing only suppresses the **notification** — the ticket or email you'd otherwise get. It doesn't stop Augmentt from generating the alert itself: snoozed alerts still show up in the Alerts feed and in reports, they just won't email, ticket, or webhook you while snoozed. If you want to stop an alert type from being generated at all, that's a different setting from snoozing — the alert type's own on/off toggle in [Enable Alert Notifications](/modules/secure/alerts/enable-alert-notifications.md).
{% endhint %}

**How specific you can get.** A snooze can be scoped to: a single user and a single alert type at one company; every user at one company; or, set at the organization level rather than per-company, every company you manage at once. Pick the narrowest scope that solves the problem so you don't accidentally quiet an alert type somewhere it's still useful.

**Managing snoozes in bulk.** Rather than hunting down individual rows, the **Rules** tab (Secure > Alerts > Rules) lists every snooze rule you've set — rule name, alert type, action, which company or user it applies to, duration, and a toggle to turn it on or off — so you can review and clean these up in one place instead of per-alert. Edit or delete a rule from its row menu.

A couple of things worth knowing:

* A time-bound snooze that has expired doesn't disappear from the Rules list automatically — it's flagged as expired but stays listed until you delete it, so don't assume an old snooze has stopped doing anything just because it's expired.
* Scope matters: a snooze set at the organization level applies across every company you manage, while a per-company snooze only affects that one client.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/alerts/how-alerts-work.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.