Alerts
Alerts continuously evaluate the security and traffic telemetry produced by TrustGuard and TrustGate and raise an alert whenever activity crosses a rule you care about — a burst of blocked prompt injections, a leaked secret, an authentication anomaly, an elevated error rate, or a cross‑product coverage gap. Instead of watching dashboards, your team enables detection use cases (rules); the platform evaluates them over rolling time windows, deduplicates matches into a single actionable alert per entity, and — when configured — forwards each finding to your SIEM. The Telemetry section of the console has three views:Alerts
The raised alerts — severity, source, entity, status, and assignee — with a detail side panel and bulk actions.
Use Cases
The rule catalog — predefined templates plus custom rules you author per team.
Integrations
SIEM destinations (Sentinel, Datadog, Splunk, Elastic, QRadar, Webhook) that receive forwarded findings.
How it works
1
Telemetry is collected
TrustGuard (guardrail detections) and TrustGate (gateway request events) emit telemetry that lands in NeuralTrust’s analytics store, scoped per team.
2
Use cases are evaluated
Each enabled use case runs on a schedule over its declared time window. A rule counts matching events per entity (consumer, session, app/gateway/collector, route, or provider) and fires when it crosses the rule’s threshold.
3
Alerts are deduplicated
Repeated matches for the same rule and entity collapse into one alert with an occurrence count and first/last-seen timestamps — so a sustained attack is one alert, not thousands.
4
Findings are forwarded (optional)
When a brand-new alert is raised, it is rendered as an Detection Finding and delivered to every connected SIEM whose filters match.
Key concepts
Detection use cases
Use cases are the rules that decide what becomes an alert.Predefined vs. custom
- Predefined use cases are global, versioned templates identified by a stable code (
nt-uc-NNN). They are read‑only — you enable or disable them per team, but you cannot edit their logic. To change a threshold or scope, copy a predefined use case into a custom rule and edit the copy. - Custom use cases are owned by your team. Create them from scratch or by copying a predefined template, then tune conditions, window, grouping, and scope in the Use Cases rule builder.
Enabling a use case is a per‑team action. A predefined template that ships with the platform does nothing until a team turns it on.
Rule types
Every use case compiles to one of four evaluation models:
Predicate combination inside a rule:
- Conditions within a
match:ordetection:block are ANDed. - OR is expressed with
any:— a list of selection groups (OR of AND-groups). The custom rule builder exposes this via And / Or connectors between condition rows.
Predefined catalog
The platform ships with the following predefined use cases. All are disabled until a team enables them.TrustGuard
TrustGate
Cross‑product
The catalog grows over time. Additional detections — posture and behavioral‑drift use cases, relative/baseline thresholds, and further cross‑product correlations — are on the roadmap.
Working with alerts
The Alerts view is a table you can search, filter, sort, and act on.Columns and filters
Each row shows the alert severity, name, source, entity, status, date, and assignee. Filter by severity, status, and source to focus a triage session, or search by name.Alert detail
Selecting a row opens a side panel with:- Details — a human summary and the evidence (related logs) that raised the alert.
- Use case — the rule, source, entity, occurrence count, and first/last‑seen times.
- Raw event — the underlying telemetry record behind the alert.
Status lifecycle
Bulk actions and assignment
Select multiple alerts to mark them Open, Acknowledged, or Resolved in one action, or assign them to a team member.Forward to your SIEM
Connect a destination in the Integrations view to stream every new alert to your security tooling as an OCSF Detection Finding — Microsoft Sentinel, Datadog, Splunk, Elastic, IBM QRadar, or a generic webhook. A connected destination forwards all matching alerts by default; optional filters narrow the stream by minimum severity or source. See Integrations for per-provider setup, filters, and delivery health.Related documentation
Use Cases
Custom rule builder, AND/OR conditions, time windows, and the full field catalog.
Event schema
Metadata schema, detection normalization, and grouping keys.
TrustGuard
The guardrail detections that feed TrustGuard use cases.
TrustGate
The AI gateway whose request telemetry feeds TrustGate use cases.
Integrations
OCSF payload format, Splunk HEC, and per-provider setup.
Audit Logs
The tenant audit trail for configuration and access events.