The
/alerts URL in the dashboard redirects to /incidents. The terms “alert” and “incident” are related but distinct: an alert is a single rule firing; an incident is a group of alerts representing a sustained or correlated threat pattern.Alert severity levels
Every alert carries one of four severity levels. Understanding what each level means helps you prioritize your triage queue.
Severity is derived from the z-score of the observed metric against your rolling baseline, or from the detection rule’s configured level when the rule is not statistical.
Filtering and searching alerts
The incident list supports several filters. You can combine them to narrow the list to exactly what you need.
Use the search bar to filter by free text — for example, an IP address, a path, or a detector name. The search applies across alert metadata including the rule name and the evidence fields.
Bulk actions
You can select multiple alerts using the checkboxes in the list, then apply an action to all selected alerts at once. Bulk actions include acknowledging, resolving, and marking as false positives.Alert detail view
Select any alert row to open the detail panel. The detail view shows:- Detector name and description — which rule fired and what it monitors
- Timestamp and asset — when the alert fired and on which connection
- Evidence fields, which can include:
- Signal value — the observed metric at the time of firing
- Threshold used — the value the signal had to exceed
- Z-score — how many standard deviations the signal was from the baseline mean
- EWMA baseline — the exponentially weighted moving average that forms the expected baseline
- Baseline mean and standard deviation — the learned normal behavior for that metric
- Blacklisted IP — if the rule fired because a known-bad IP was observed
- Suspicious request count — volume of requests matching the suspicious pattern
- Affected paths — which URL paths and HTTP methods contributed to the signal, with per-path error rates
- Time-series graph — minute-by-minute view of the metric with the baseline overlaid
- AI triage summary — a plain-English explanation of what the alert means and suggested next steps (available on Complete and Enterprise plans)
- Suggested actions — concrete remediation steps recommended by the detection engine
Taking action on alerts
Three actions are available on every alert:1
Acknowledge
Select Acknowledge to mark the alert as seen and under investigation. The status changes from open to acknowledged. Use this when you’re actively working the alert.
2
Resolve
Select Resolve when you’ve confirmed the issue is mitigated or was not a real threat. Resolved alerts are retained for reference but no longer appear in the open queue.
3
Mark as false positive
Select False positive if the alert fired incorrectly — for example, if a scheduled load test triggered a rate spike detection. This is the most impactful action you can take to improve detection quality.
False positive feedback
When you mark an alert as a false positive, Flarehawk records your feedback and uses it to adjust future detection behavior for that rule on your asset. Specifically:- The signal that triggered the alert is used to raise the detection threshold for that pattern.
- Future events with the same fingerprint are less likely to fire during similar traffic conditions.
- Your feedback is scoped to your organization — it does not affect other customers’ detection.