> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts.md).

# Monitored Alerts

This is the alert catalog itself — the full list of what Augmentt can detect, grouped into nine umbrellas. Each umbrella has its own data source and licensing requirement, so what a client sees depends on what they're licensed for in Microsoft 365. Alert Type is the internal code identifier for that alert (useful if you're cross-referencing a webhook payload's `alert_type` field against this catalog).

{% hint style="info" %}
Severity shown below is Augmentt's **seeded default** for each alert type — it's configurable per organization from **Secure > Alerts > Settings**, and a handful of alert types report severity dynamically (shown as **Variable**) based on the underlying Microsoft signal rather than a fixed default.
{% endhint %}

## In this section

* [**M365 Monitored Alerts**](/modules/secure/alerts/monitored-alerts/m365-monitored-alerts.md) — Unified Audit Log-based, Basic (non-P1) licensing, \~40 alert types.
* [**M365 Defender (Incidents & Alerts)**](/modules/secure/alerts/monitored-alerts/m365-defender-incidents-and-alerts.md) — Microsoft Defender / Cloud App Security / Sentinel-sourced, Entra ID P2 licensing, the largest event-based catalog at \~90 alert types.
* [**Purview Alerts (UAL)**](/modules/secure/alerts/monitored-alerts/purview-alerts-ual.md) — sign-in risk alerts built on top of the Unified Audit Log, Basic (non-P1) licensing.
* [**M365 Risk Detections**](/modules/secure/alerts/monitored-alerts/m365-risk-detections.md) — Microsoft's own Entra ID Protection anomaly detection, Entra ID P1 licensing, not suppressed by Safe Locations.
* [**Posture Drift Alerts**](/modules/secure/alerts/monitored-alerts/posture-drift-alerts.md) — fires when a Security Posture check's compliant/non-compliant state changes, 132 alert types, all seeded with a uniform Category (Posture Drift) and Severity (Medium).
* [**Directory Audit Alerts**](/modules/secure/alerts/monitored-alerts/directory-audit-alerts.md) — Microsoft Entra ID directory-level admin activity (accounts, apps, devices, groups, policies, roles), Unified Audit Log-based, 47 alert types.
* [**UAL Mailbox Rule Alerts**](/modules/secure/alerts/monitored-alerts/ual-mailbox-rule-alerts.md) — inbox-rule creation/edit activity commonly tied to business email compromise (auto-forward, redirect, suspicious naming, mail deletion), 9 alert types.
* [**Scheduled Action Alerts**](/modules/secure/alerts/monitored-alerts/scheduled-action-alerts.md) — outcome reporting for Augmentt's own scheduled actions (currently, Engage offboarding tasks), 2 alert types.
* [**Dedicated Posture Alerts**](/modules/secure/alerts/monitored-alerts/dedicated-posture-alerts.md) — standalone security-posture alerts (Admin MFA, User MFA, Block Legacy Auth) separate from the broader Posture Drift catalog, 3 alert types.

{% hint style="warning" %}
Most of these umbrellas are Augmentt's **event- and signal-based** alerts — they fire when something happens (a sign-in, an audit log entry, a Defender detection, a directory change). **Posture Drift** is a different mechanism entirely: it fires when a Security Posture check's own state changes, not when an event occurs. See its page for the full 132-check catalog (CISA/SCuBA, EIDSCA, Maester, and Defender for Office 365 configuration baselines). **Dedicated Posture Alerts** are a small, separate set of standalone posture checks that are not part of that 132-check Posture Drift catalog.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.