About triggered alert management
The articles below describe tasks related to interacting with triggered alerts as part of the workflow to analyze them and act according to the results.
What permissions do I need?
These are the minimum permissions required to performed the actions described in the articles below (visit Working with triggered alerts for a detailed description).
Triggered alerts (View) → needed to see alert details, explore alert queries, create annotations, and create post filters.
Read/unread alert → needed to change alert status and priority.
Triggered alerts (Manage) → needed to delete triggered alerts but it also enables all the above.
Alert configuration (Manage) → needed to edit and clone alert definitions.
Additionally, you need to have alerts assigned with View access to see alert details or query and Manage access for the rest of the actions (see Assign resources to a role).