Security Alerts

​

Overview

Enclave runs two parallel alerting engines on top of every audit event:

• Policy Alerts — fire when a specific audit action occurs (e.g. a room is deleted, a user’s role changes). Configured at Security → Policies → Alert Policies.
• Behavioral Anomaly Detection — fire when a user’s file-access pattern deviates from their baseline (bulk downloads, access from a new country, off-hours activity). Configured at Security → Alert Policies → Rules.

Both engines write to the same alert dashboard (Security → Alerts) and send in-app notifications, email, and Slack messages to all active Owners and Security Officers in the tenant.

---

​

Policy Alerts

​

How they work

Every audit log entry passes through the policy alert engine immediately after it is persisted. The engine compares the event against the tenant’s active alert policy set. If a matching enabled policy is found — and the policy’s cooldown period has not elapsed — an alert is created and notifications are sent.

​

System defaults

Eleven policies are active out of the box. Policies marked System are platform-required controls — they cannot be deleted. Disabling one shows a compliance warning in the UI and records the action in the audit log.

​

Alert cooldown

When a policy has a cooldown configured, subsequent matches for the same event within that window do not create duplicate alerts. This prevents notification fatigue during sustained incidents — for example, a bulk-deletion event that would otherwise fire hundreds of individual alerts within seconds. Cooldown is per-tenant and resets independently for each organisation.

​

Managing policies

Go to Security → Policies → Alert Policies to:

• Toggle individual policies on or off
• Adjust the severity level per policy
• Change or remove the cooldown period
• Add a custom policy for any event in the supported catalog

To add a custom policy, click Add Policy and select an event from the searchable event picker, then set a name, severity, and optional cooldown. The picker groups events by category and shows a description of what each event represents so you can choose accurately. Custom policies cannot be created for the same event as an existing system default — use the toggle and severity controls on the existing system entry instead.

---

​

Supported alert events

Alert policies can be configured for any of the following 40+ audit events. System defaults are marked with ★.

​

Authentication

​

Files — My Files

​

Files — Secure Rooms

​

Secure Rooms

​

Users & Access

​

E-Signatures

​

Approvals

​

Secrets

​

DLP

​

KMS

​

Storage

★ = System Default (pre-wired, cannot be deleted)

---

​

Behavioral Anomaly Detection

​

How it works

The anomaly engine evaluates every file-access event against a set of configurable detection rules. It checks access counts, timestamps, geolocation, and device fingerprints — and creates an alert if a rule threshold is crossed. Anomaly alerts are scoped to the room (or My Files for personal uploads) and include the file name, actor, severity, and structured detail about what triggered the rule.

​

Detection rules

Five rules are enabled by default. All thresholds and time windows are configurable at Security → Alert Policies → Rules.

​

My Files coverage

Anomaly detection applies to files accessed outside Secure Rooms, including My Files and files accessed via shared links. These alerts use My Files as the room label. Notifications fall back to the tenant’s alert email list when no room context is available.

​

Tuning a rule

Go to Security → Alert Policies → Rules and click the rule you want to adjust. You can change the threshold count, time window, cooldown period, and minimum classification level without disabling the rule. Toggle the rule off to suspend it entirely.

---

​

Alert dashboard

All alerts — both policy alerts and anomaly alerts — appear in Security → Alerts. Each alert entry shows:

• Severity — Critical / High / Medium / Low
• Type — policy alert name or anomaly rule
• Actor — user who triggered the event
• Resource — file or room involved
• Time — UTC timestamp
• Detail — structured breakdown of what triggered the alert (access counts, country, device, etc.)

Alerts can be filtered by severity, type, date range, and actor.

​

File lock

For anomaly alerts involving a specific file, admins can lock the file directly from the alert entry. A locked file is suspended from further access while the incident is investigated. Access resumes when the admin manually unlocks the file or the lock window expires.

---

​

Notifications

When an alert fires, Enclave notifies all active Owners and Security Officers in the tenant:

• In-app — notification bell with alert title and brief summary
• Email — formatted message with full detail, actor information, and a direct link to the alert
• Slack (if configured) — message to the configured webhook with severity indicator and context

Notification settings — including the Slack webhook URL and a configurable email override list — are managed at Security → Alert Policies → Settings.

---

​

Alert severity levels

---

​

Compliance mapping

The alert categories and system defaults are designed to address common requirements across major compliance frameworks: Refer to the Compliance page for a full framework mapping.