Alerts

The Alerts page shows the alerts triggered by your policies and guardrails. Use it to respond quickly to high-risk events, policy violations, and other significant AI activity, and to keep control over how AI is used in your organization.

Alerts can also be forwarded to common security information and event management (SIEM) platforms. See Administration → Configuration for SIEM integration.

Topics
• Prerequisites
• Open the Alerts page
• Filter alerts
• Search alerts
• Choose columns and export
• Sort alerts
• Column reference
• Review an alert
• Triage and label alerts
• File attachments in alerts
• Verify

Prerequisites

Access to the WitnessAI Console with permission to view Alerts.
Policies with guardrails configured so that AI activity generates alerts. See Data Protection guardrail and Policies.
To reveal masked sensitive values in an alert, the appropriate role to unmask data.

Open the Alerts page

Select Alerts in the left navigation. The table lists alerts for the selected time range, which starts at Last 24 hours. On larger deployments the date picker caps how long a window you can choose. To make more room for columns, collapse the left navigation using the arrow button on its edge.

The Alerts table with the filter bar above it and the Action, Severity, Risk Type, Intent, User, Application, Policy, Behavior Types, Date and Labels columns.

Alerts in the WitnessAI Console.

Filter alerts

A filter bar sits above the table. By default it shows these filters, left to right:

The Alerts filter bar: Last 30 days, Severity, User, Group, Application, Guardrail, Risk Type, Action and Policy, then the Additional filters button and Clear.

Filter	What it does
Date Range	Filters alerts to a date and time range. It's always in the bar and can't be removed.
Severity	Filters alerts by High, Medium, or Low severity.
User	Filters alerts to a user.
Group	Filters alerts to a user group.
Application	Filters alerts to an AI application.
Guardrail	Filters alerts to those a given guardrail raised.
Risk Type	Filters alerts to one or more Risk Types.
Action	Filters alerts by the action taken: allowed, warned, redacted, or blocked.
Policy	Filters alerts to one or more Policies.

The User, Group, and Application filters each take one value at a time.

More filters are available from the Additional filters button at the end of the bar:

Filter	What it does
Data Type	Filters alerts to those where a given kind of sensitive data was detected, such as a US Social Security Number or a Credit Card Number.
Label	Filters alerts to those carrying a given label.
Capture time	Available only where offline prompt capture is enabled for your environment.

Customize the filter bar

Select Additional filters to choose which filters sit in the bar. Check a filter to pin it to the bar, uncheck it to remove it, and drag the handles to change the order. The date range stays locked in first place. Your layout is saved, so the bar looks the same on your next visit. When there are more filters than fit on one row, the bar wraps.

The Additional filters menu, with the locked date range followed by Severity, User, Group, Application, Guardrail, Risk Type, Action and Policy checked, and Data Type and Label unchecked.

Once a filter is set, the Clear control resets all active filters and date range, reverting to your environment default.

Note that switching to another dashboard, such as Conversations or Analytics, resets the Alerts dashboard’s date range to your environment default.

Search alerts

The text search field is displayed in the upper-right of the header area, next to the Download control. It enables plain text search of three fields.

Mode	What it searches
Search Prompts	The prompt text of each alert.
Search Topics	The topic detected for each alert.
Search Intents	The intent detected for each alert.

To switch modes, select the chevron (▾) in the search input and choose a mode. Switching modes clears the current search term. Results update automatically as you type, so there's no Apply button.

The alerts search input with its mode dropdown open, showing Search Prompts (checked), Search Topics, and Search Intents.

Choose columns and export

Above the table on the right side of the header, you can export the view:

Column picker. Choose which columns to display. Username and Email are hidden by default; you can also show Topic and Subtopic. Prompt text, response text, and application category are available in exports only and do not appear as table columns.
Download. Select Download, then Download CSV (alerts.csv) or Download JSON (alerts.json).

Note: Only the selected alerts are exported, or the alerts on the current page when none are selected. The export doesn't include the full set matching your filters, so narrow your filters first if you need a specific set.

Warning: Exported files include the raw, unmasked prompt and response text for every exported alert, regardless of whether you have unmasked that content in the panel. Treat exported files as sensitive and handle them according to your organization's data-handling policies. Exports also include the application category, which does not appear as a table column.

Sort alerts

Select the Date column header to sort by date. Selecting it again reverses the direction; a third selection returns the table to its default order.

Note: Sorting is available on the Date column.

Column reference

Column	Description
Severity	The severity of the alert: High, Medium, or Low. An alert with no recorded severity shows as High.
Risk Type	The type of risk that triggered the alert.
Intent	The detected intention behind the prompt.
User	The person whose activity triggered the alert.
Username	The user's account name. Hidden by default.
Email	The user's email address. Hidden by default.
Application	The AI application involved, shown with its provider logo.
Policy	The policy that triggered the alert.
Behavior Types	The Behavioral Activity, Model Identity Protection, or Organizational Behavior behaviors that triggered the alert, so you can see which rule fired without opening the alert. Shown by default and always included in exports.
Action	The action taken, shown as a badge (for example, allowed, warned, redacted, or blocked).
Date	When the alert occurred.
Labels	Labels applied to the alert. The cell shows the first label, then a +N more badge for the others.
Topic	The topic detected. Hidden by default; also included in exports.
Subtopic	The subtopic detected. Hidden by default; also included in exports.

Review an alert

Select any alert row to open the Alert Details panel. The panel header shows the risk type, a description of what happened, the severity, the date, and the action taken. Use the × button or press Escape to close the panel.

The panel has two tabs: Overview and Matches.

The Overview tab summarizes the policy, the guardrail that fired, and the prompt that triggered the alert.

Overview tab

The Overview tab answers "what happened?" It contains the following sections in order:

POLICY: The policy that triggered the alert, with its name, description, and version. Select the policy name to open the policy.
GUARDRAILS: One card for each guardrail that matched, showing the guardrail name and the number of matches. Where the guardrail detected sensitive data, the card also names the data types it matched, prefixed with Matched:, so you can see what triggered the alert without opening the Matches tab. Where nothing was detected, the card shows the guardrail's own message instead. Select the match count to jump to the Matches tab for that guardrail's detail. If the alert was triggered by the Organizational Behavior guardrail, that card appears first and works differently (see below).
CONVERSATION: The conversation that contained the triggering prompt, shown with masked text and a link to the full conversation. Use the eye icon to reveal all masked content in this section (role-permitting).
PROMPT: The specific prompt that triggered the alert, shown with masked text. Use the eye icon to reveal masked content.
ATTACHMENTS: Appears only when the alert includes file attachments (for example, a blocked file upload). Lists the attached files.
CLASSIFICATION: The topic, subtopic, and intent WitnessAI detected for this event. Fields read "Not classified" if no classification was determined.
SOURCE: The user who triggered the alert.
DESTINATION: The AI application the user was interacting with.
ADDITIONAL DETAILS: The prompt ID, conversation ID, and (when available) timing metrics for security evaluation. Timing values appear only when they are greater than zero.

Masking and unmasking. All content in the panel starts masked. The eye icon in each section toggles the masked state for that section. Individual redacted tokens can also be revealed one at a time by selecting them. Unmasking requires the appropriate role. If the underlying value is not available to your role, selecting the eye icon has no effect.

Note: If the conversation or prompt content is unavailable in the panel, a message indicates this. This may occur if the content is restricted to your role or is no longer available. Contact your administrator if you expect to have access.

Organizational Behavior guardrail card

When the Organizational Behavior guardrail triggered the alert, its card appears first in the GUARDRAILS section. Select the card to expand it and see the related prompts that, together, form the behavioral pattern behind the alert, not just the single prompt that crossed the threshold. Each related prompt shows masked text and links to its conversation. Use the mask toggle in the card to reveal masked content (role-permitting).

Matches tab

The Matches tab label shows how many matched values the alert has. The tab is always available. When the guardrail recorded no matched values, as with a behavioral or harmful-response alert, it shows No matched values to display.

The Matches tab groups matched values by the kind of data detected and counts each one.

When the guardrail did record matched values, the Matches tab shows an accordion with one section per kind of data detected, not one section per guardrail. Each header names the data type and the number of matches, for example US Social Security Number 2.

Sections start expanded, so you can usually read the matches without opening anything. If an alert has more than ten matches in total, only the first section starts open.

Inside a section, each match appears as a snippet of the surrounding prompt with the matched value masked. Select a masked value to reveal it, if your role permits.

Data types come from a fixed set of labels, among them US Social Security Number, Credit Card Number, Email Address, Phone Number, IP Address and Name. A type WitnessAI has no label for is shown as a title-cased version of its internal code.

Per-token reveal. Within the Matches tab, individual redacted tokens can be revealed one at a time by clicking them, if you have the appropriate role. This is the same role required to use the eye icon on the Overview tab.

If you arrived at the Matches tab by selecting a match count badge on a guardrail card in the Overview tab, that guardrail's accordion section opens automatically.

Triage and label alerts

Labels let you triage alerts (for example, marking them Reviewed, False positive, or Escalated). You can apply existing labels or create new ones, with a maximum of three labels per alert. Each label is limited to 42 characters.

Label a single alert

Open the alert's detail panel.
Select + Add Label (if the alert has none) or Edit Labels (to change existing labels).
Choose an existing label, or type a new one to create it (42-character maximum).
Close the panel to save.

Note: If you try to add a label that would bring an alert past three labels, you'll see a notification.

Label alerts in bulk

Select the checkbox next to each alert you want to label, or select the header checkbox to select all alerts on the current page. A toolbar with bulk label options appears above the table.
Open the bulk Label dialog from the toolbar.
Choose the operation:

Add Labels: add labels to the selected alerts, keeping their existing labels.
Replace Labels: replace all labels on the selected alerts with the ones you choose.
Remove Labels: remove the labels you choose from the selected alerts.

Apply the change.

Note: Each alert can hold at most three labels, so an Add Labels operation that would exceed three is limited accordingly.

File attachments in alerts

When a file upload is blocked, it generates an alert. These alerts are identified as file-upload events in the Intent column. Open the alert to see the details.

For policy controls over uploads, see File Attachments.

Verify

Select Alerts in the left navigation. The table shows alert rows for the current time range and any active filters. After applying a filter, the row count above the table updates to reflect only the matching alerts. After labeling an alert and closing the Alert Details panel, confirm the Labels column on that alert row shows a label.

The column is deliberately compact: it renders the first label as a badge and collapses the rest into a +N more badge. So an alert carrying three labels shows one name and +2 more. That's the column working as designed, not two labels being lost. Reopen the alert to see all of them.

Alerts Prerequisites Open the Alerts page Filter alerts Customize the filter bar Search alerts Choose columns and export Sort alerts Column reference Review an alert Overview tab Organizational Behavior guardrail card Matches tab Triage and label alerts Label a single alert Label alerts in bulk File attachments in alerts Verify