# What should every security alert include?

Enough to act without detective work: which host and account, what was seen, when it started, why it is unusual for this host, how confident the tool is, and what to check next. A good alert also says where the evidence is, for example the connections involved, so the reader can confirm it, and which other alerts belong to the same story. An alert that only names a rule or a score sends the analyst back to the raw data, and in a small team that usually means it gets ignored. When you evaluate a tool, ask for three real alerts and give them to the colleague who would read them at 08:00: could they decide in five minutes whether to escalate? Every NetSenX alert carries a plain-language explanation of why it fired and which network features drove its score, on every plan, and the audit log keeps what was done about it and by whom.

FAQ: [Budget, staff and alert noise](https://netsenx.com/en/faq/budget) · https://netsenx.com/en/faq/what-should-every-security-alert-include

## Read next

- https://netsenx.com/en/pricing
- https://netsenx.com/en/ndr-for-small-business

## Related questions

- [What is a realistic false-positive rate for NDR?](https://netsenx.com/en/faq/what-is-a-realistic-false-positive-rate)
- [We get too many false positives. How do we tune without missing real attacks?](https://netsenx.com/en/faq/how-to-tune-false-positives-without-missing-real-attacks)
- [How long until a new security tool stops being noisy?](https://netsenx.com/en/faq/how-long-until-a-new-security-tool-is-quiet)
- [How much time does a small team need to run NDR?](https://netsenx.com/en/faq/how-much-time-does-a-small-team-need-to-run-ndr)
- [How much should a small business spend on cyber security?](https://netsenx.com/en/faq/how-much-should-a-small-business-spend-on-cyber-security)