{"id":2545,"date":"2025-07-02T12:23:43","date_gmt":"2025-07-02T12:23:43","guid":{"rendered":"https:\/\/zecurit.com\/help\/docs\/asset-manager\/asset-management\/policy-association-to-groups\/"},"modified":"2025-07-04T15:14:11","modified_gmt":"2025-07-04T15:14:11","slug":"policy-association-to-groups","status":"publish","type":"docs","link":"https:\/\/zecurit.com\/help\/asset-management\/asset-management\/alerts-compliance\/policy-association-to-groups\/","title":{"rendered":"Policy Association to Groups"},"content":{"rendered":"\n

Zecurit lets you define granular alert policies<\/strong> and associate them with device groups<\/strong>, so that alerts are automatically triggered when defined conditions are met. These alerts serve as early warning indicators for IT teams, helping them monitor changes, threats and compliance issues across the environment.<\/p>\n\n\n\n

Step 1: Associate Policy to Groups<\/strong><\/h2>\n\n\n\n

Once an alert policy<\/strong> is created and published, associate it with the relevant device groups:<\/p>\n\n\n\n

    \n
  1. Navigate to Alerts \u2192 Associate Policy<\/strong> tab.<\/li>\n\n\n\n
  2. Select one or more device groups<\/strong> from the list.<\/li>\n\n\n\n
  3. Click \u201cAssociate Policy\u201d<\/strong>.<\/li>\n\n\n\n
  4. In the popup window, select from available published alert policies<\/strong>.<\/li>\n\n\n\n
  5. Click Associate<\/strong> to apply them to the selected groups.<\/li>\n<\/ol>\n\n\n\n
    \n

    Only published policies can be associated.<\/p>\n<\/blockquote>\n\n\n\n

    Viewing Policy Count by Group<\/strong><\/h3>\n\n\n\n
      \n
    • In the group list, the Policy Count<\/strong> column shows how many alert policies are assigned to each group.<\/li>\n\n\n\n
    • Click the policy count<\/strong> number to view:\n
        \n
      • Group details<\/li>\n\n\n\n
      • Associated policy names<\/li>\n\n\n\n
      • Policy type and severity<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n

        Step 2: Alerts Tab: Reviewing Triggered Alerts<\/strong><\/h2>\n\n\n\n

        Once an associated policy condition is met during an inventory scan<\/strong>, an alert is automatically generated<\/strong> and an email notification<\/strong> is sent to the configured recipients.<\/p>\n\n\n\n

        Access the alerts from the Alerts \u2192 Alerts<\/strong> tab.<\/p>\n\n\n\n

        Alert Table Includes:<\/strong><\/h3>\n\n\n\n
        Field<\/strong><\/th>Description<\/strong><\/th><\/tr><\/thead>
        Level<\/strong><\/td>Severity of the alert (Critical, High, Medium, Low)<\/td><\/tr>
        Alert Type<\/strong><\/td>Type of alert (e.g., Hardware Added, Software Installed, License Expired)<\/td><\/tr>
        Time<\/strong><\/td>Timestamp when the alert was triggered<\/td><\/tr>
        Computer Name<\/strong><\/td>Name of the device where the condition was detected<\/td><\/tr>
        Alert Message<\/strong><\/td>Description of what triggered the alert<\/td><\/tr>
        Remarks<\/strong><\/td>Admin can add notes, comments, or investigation steps<\/td><\/tr>
        Status<\/strong><\/td>Track resolution with statuses: Open, In Progress, Resolved, Dismissed<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

        Admins and technicians can update status<\/strong> and add remarks<\/strong> for follow-up or escalation.<\/p>\n\n\n\n

        Why this feature matters<\/strong><\/h2>\n\n\n\n

        This alerting system helps your IT and Help Desk teams:<\/p>\n\n\n\n

          \n
        • Proactively detect and respond<\/strong> to hardware\/software\/configuration changes.<\/li>\n\n\n\n
        • Ensure compliance<\/strong> with internal policies and regulatory standards.<\/li>\n\n\n\n
        • Quickly mitigate threats<\/strong>, such as disabled antivirus or expired certificates.<\/li>\n\n\n\n
        • Track and resolve incidents efficiently<\/strong> with alert statuses and comments.<\/li>\n\n\n\n
        • Integrate with ticketing workflows<\/strong>, using alerts as automated triggers for ticket creation, escalation and resolution tracking.<\/li>\n<\/ul>\n\n\n\n

          By keeping alerts group-targeted and actionable<\/strong>, Zecurit ensures better visibility<\/strong>, faster response<\/strong> and smarter management<\/strong> of your endpoint infrastructure.<\/p>\n\n\n\n

          Alert Status Lifecycle<\/strong><\/h1>\n\n\n\n

          Zecurit\u2019s Alert Status Lifecycle<\/strong> helps IT admins and support teams track, manage and resolve alerts efficiently<\/strong> by organizing each alert through well-defined statuses. This system ensures that critical incidents are acknowledged, investigated and resolved<\/strong> in a structured and auditable manner.<\/p>\n\n\n\n

          Available Alert Statuses<\/strong><\/h2>\n\n\n\n
          Status<\/strong><\/th>Purpose<\/strong><\/th>When to Use<\/strong><\/th><\/tr><\/thead>
          Open<\/strong><\/td>Default status when an alert is generated<\/td>Use this to indicate a newly raised issue that hasn\u2019t been reviewed yet<\/td><\/tr>
          In Progress<\/strong><\/td>Assigned for active investigation or troubleshooting<\/td>When an admin or technician begins working on the alert<\/td><\/tr>
          Resolved<\/strong><\/td>Issue has been fixed or the condition is no longer valid<\/td>Use when the root cause has been addressed (e.g., disk space freed, software removed)<\/td><\/tr>
          Dismissed<\/strong><\/td>Alert is acknowledged but requires no action<\/td>Use for known or non-critical conditions (e.g., approved software installed)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

          How to Manage Alert Status<\/strong><\/h2>\n\n\n\n
            \n
          1. Navigate to Alerts \u2192 Alerts<\/strong> tab.<\/li>\n\n\n\n
          2. Select an alert from the list.<\/li>\n\n\n\n
          3. Click the Status dropdown<\/strong> to change the current status.<\/li>\n\n\n\n
          4. Optionally, add notes in the Remarks<\/strong> field for tracking investigation steps, findings, or ticket references.<\/li>\n<\/ol>\n\n\n\n
            \n

            Status updates are logged in the activity system for audit trails.<\/p>\n<\/blockquote>\n\n\n\n

            Use Cases & Best Practices<\/strong><\/h2>\n\n\n\n
            Use Case<\/strong><\/th>Recommended Status<\/strong><\/th><\/tr><\/thead>
            New USB device detected on a critical server<\/td>Open \u2192 In Progress \u2192 Resolved<\/td><\/tr>
            Antivirus disabled due to user action<\/td>Open \u2192 In Progress \u2192 Resolved<\/td><\/tr>
            Prohibited software installed but allowed by exception<\/td>Open \u2192 Dismissed<\/td><\/tr>
            License expired but renewal is underway<\/td>Open \u2192 In Progress<\/td><\/tr>
            Routine hardware change by IT team<\/td>Open \u2192 Dismissed with remarks<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

            Why use Alert Lifecycle?<\/strong><\/h2>\n\n\n\n
              \n
            • Keeps teams accountable<\/strong> by assigning ownership and tracking resolution progress.<\/li>\n\n\n\n
            • Provides context<\/strong> through remarks for every alert.<\/li>\n\n\n\n
            • Avoids alert fatigue by dismissing false positives<\/strong> and reducing noise.<\/li>\n\n\n\n
            • Improves auditability<\/strong> and compliance through status tracking.<\/li>\n\n\n\n
            • Supports integration with ITSM systems<\/strong>, mapping alert status to ticket workflows.<\/li>\n<\/ul>\n\n\n\n

              Access Control<\/strong><\/h2>\n\n\n\n
                \n
              • Only users with appropriate permissions (Admin\/Technician) can change alert statuses and add remarks.<\/li>\n\n\n\n
              • All changes are logged under the Activity Log<\/strong> module.<\/li>\n<\/ul>\n","protected":false},"featured_media":0,"parent":2543,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-2545","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/2545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/comments?post=2545"}],"version-history":[{"count":2,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/2545\/revisions"}],"predecessor-version":[{"id":2658,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/2545\/revisions\/2658"}],"up":[{"embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/docs\/2543"}],"wp:attachment":[{"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/media?parent=2545"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/zecurit.com\/help\/wp-json\/wp\/v2\/doc_tag?post=2545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}