What happens to events below the escalation threshold?
Events that fall below an alert type's escalation threshold do not become alerts. They are kept as non-escalated events that you can search, review and escalate.
Prerequisites
-
Permissions to View/Edit Alerts Settings required to change the escalation threshold.
Overview
For Active alerts, each event Kinectify detects gets a Confidence Score. If the score is at or above the alert type's Escalation threshold, the event becomes an alert for analyst review. If it is below, the event is classified as a non-escalated event. Non-escalated events are viewable in the Non-Escalated Events log.
Instead of creating alerts and then resolving them automatically, activity below the threshold never reaches the alert queue. It is still recorded, searchable and auditable, so you can review it at any time and escalate it if a broader pattern emerges.
Additional Tips
-
Organizations still using Legacy alerts set auto resolve in Settings > Alerts instead. See the article What is the auto resolve configuration? for those steps.