Installing and working with alert packs in Exchange
- Borja Moro Moreno
About alert packs
Predefined sets of alerts, each to be installed individually for a needs-based usage, based on specific queries to warn you about anomalous situations in the context of specific use cases.
The alerts contained in the pack are not available individually in Exchange. However, there might be alert packs consisting only of one alert.
Visit Alerts and notifications to know more.
What permissions do I need?
Apart from the Exchange (manage) permission required to access Exchange and install content, the Alert configuration (manage) permission is also required to install/uninstall alert packs via Exchange.
Requirements & additional info
Apart from the requirements described in the Required data sources section, certain alerts require the installation of specific lookups for a correct functioning. These lookups will be indicated in the description, displayed in bold inside a Requirements paragraph.
Here you can also find an info button for each alert so that you can check their purpose and a code button to check their queries, as well as additional columns with their priority and data source.
Searching for specific alerts
You can see the total number of alerts contained in the pack and how many of them are installed in your domain. It is displayed at the top right of the open card and at the bottom of the card thumbnail. This helps you identify the proportions of the pack and understand their significance within your domain.
You have at your disposal a search box and a set of filters to help you find the desired alert. This is especially useful with alert packs that contain a great number of alerts, which might be cumbersome to navigate.
The search will find matches within the Alert name and Sources columns, while the filters provide additional options to refine results based on priority or installation status (installed vs. uninstalled). The Source dropdown inside the filters shows all the data sources that feed the alert pack, offering the possibility to show alerts based on their data source (selecting several of them will show alerts fed by any of them).
Install and uninstall
How to install
Alert packs cannot be installed collectively and thus the Install button does not appear at the top right of the card. Each of the alerts must be installed individually by clicking the Install button each of them has in the Included alerts section.
However, you can install alerts in bulk using the multi-select feature. Simply check the boxes of the desired alerts and use the menu next to the master checkbox at the top.
If you select alerts with different status (installed, uninstalled, or updatable), the bulk actions menu will show all possible actions, but each of them will affect only the alerts with the status for which the action is possible.
Alerts in Exchange are installed using the Alerts API (click here to know more about it) and they are inactive by default so you can activate them as you see fit.
How to uninstall
As with the installation process, alert packs cannot be installed collectively. You can either uninstall them one by one by making use of their corresponding uninstall buttons or uninstall them in bulk using the multi-select feature (see the installation or update processes above for reference).
If you select alerts with different status (installed, uninstalled, or updatable), the bulk actions menu will show all possible actions, but each of them will affect only the alerts with the status for which the action is possible.
Open and navigate
When an alert is installed, the whole alert pack is displayed as installed, now displaying an Open button at the top right of the card.
The Open button allows you to access the Alert Configuration area in a new browser tab, so that you can keep your current session while working with alerts. In the Alert Configuration area, you must select the subcategory (it coincides with the alert pack name) to see the alerts and activate them.
You can also return to the content in Exchange by clicking the back arrow on your browser and, in case it is part of a content pack that you accessed through the Included content section, you can click the back arrow at the top left of the card to go back to the content pack.
Update
Compare with current version
As with the installation process, alert packs cannot be updated collectively. When a new version of an installed alert is available, an Update button will appear in the corresponding alert row, and the code button will show an icon to indicate changes in the query. Clicking the code button opens a query comparison of the currently installed alert and the updated version, displaying changes in green and red.
In case you have customized the alert query and wish to retain some of the clauses from the old query, we suggest copying it elsewhere using the copy button. This way, you can include them after the update.
About query customization
When customizing an alert query, the alert will display the option to update because it differs from the original and is considered in need of an update, even when there isn’t one. Ensure you identify the changes you make so that they are not mistaken for updates.
How to update
As with the installation process, alerts must be updated individually or using bulk actions. To update a single alert, simply click the Update button. To update several alerts, check their boxes and use the menu next to the master checkbox at the top.
If you select alerts with different status (installed, uninstalled, or updatable), the bulk actions menu will show all possible actions, but each of them will affect only the alerts with the status for which the action is possible.
Â