Threat Management

Alerts, dashboards, and forwarding to your SIEM.

Alerts page

The Alerts page lists violations detected by the guardrails. Alerts are tagged:

• Detected — produced by guardrails operating in Monitor mode or detections made via Non-forwarding mode.
• Blocked — prompts dropped by guardrails in Block mode during in-line deployment.

Each alert exposes the prompt, the guardrail decisions, per-layer scores, and any operator action taken. Click the alert’s ID to open the drill-down view.

Exporting alerts

Click Generate CSV at the top of the Alerts page to export the current alert set.

Dashboard summary

The Dashboard page provides a quick overview — total alerts, top guardrails firing, timeline views, and per-application breakdowns.

SIEM forwarding

Alerts can be forwarded to an external log collector. Protector Plus currently supports SYSLOG-over-UDP.

1. Open SIEM Integration

   Left-hand panel → SIEM Integration.

2. Enter the collector address

   Provide the IP address and UDP port of your log collector.

3. Enable forwarding

   Toggle the forwarding switch on.

4. Save

   Save the settings. Events begin flowing immediately.

SIEM-forwarding configuration is restricted to Super Admin users only.

What gets forwarded

Event class	Description
Dashboard login activity	Authentication events for the management console.
Security events	Per-request guardrail decisions, including Detected and Blocked outcomes.

All events, regardless of deployment mode or application profile, can be forwarded to a single SIEM destination.