Alerts & Incidents is where you triage the network-security alerts raised by OpenNVR’s built-in Suricata IDS. Each row is an intrusion-detection alert with its severity, category, signature, and the source/destination endpoints involved. You’ll find it under Governance → Alerts & Incidents in the sidebar.

[!NOTE] Viewing alerts requires the alerts.view permission. A separate alerts.manage permission (“Acknowledge/dismiss alerts”) is defined for triage actions.

What you can do here

• See every Suricata alert in a single virtualised table (it can render thousands of rows).
• Filter to Alerts only, and by severity — High, Medium, or Low.
• Click any Category to filter the table to that category, then clear it.
• Read the Source and Destination endpoints (IP:port) for each alert.

Alerts are read from Suricata’s eve.json (alert events); if that’s empty OpenNVR falls back to parsing Suricata’s fast.log. Rows are sorted newest-first. A counter shows “Showing N alerts” and any active filters.

The alert table

Column	What it shows
Time	Alert timestamp (local time)
Severity	High / Medium / Low (Suricata severity 1 / 2 / 3)
Category	Suricata alert category — click to filter by it
Signature	The rule signature that fired
Source	Source IP (and port)
Destination	Destination IP (and port)

[!NOTE] Severity maps directly to Suricata’s numeric levels: 1 = High, 2 = Medium, 3 = Low.

Triage alerts

1. Click Alerts only to hide non-alert events.
2. Narrow by severity with the High, Medium, and Low filter buttons (they toggle — click again to clear).
3. Click a Category value in any row to filter the whole table to that category. A Category: … × chip appears; click it to remove the filter.
4. Read the Signature and Source → Destination to understand what fired and where.

Active filters are reflected in the URL (e.g. ?only_alerts=1&severity=1), so dashboards can deep-link straight into a filtered view — for example the Dashboard and System monitoring pages link here pre-filtered to high-severity alerts.

[!NOTE] The current build is a read-only triage surface — filter, drill down, and inspect. The alerts.manage permission is defined for acknowledge/dismiss actions, but those controls are not present on this page in the current build.

The live “Detected Anomalies” stream

OpenNVR also surfaces a live-tailing Detected Anomalies feed. It streams new Suricata alerts as they happen from /api/v1/suricata/alerts/stream (a tail of fast.log), keeping the most recent 200 lines.

[!TIP] The live Detected Anomalies stream renders at the top of the AI Engine (Anomaly AI Engine) view, not on this Alerts & Incidents page. Use Alerts & Incidents for filtering and triage of the full history; use the live stream to watch anomalies arrive in real time.

The live table has columns Time, Message, Class, Priority, Proto, Source, and Dest. It offers a Mark all as read button, and — when the tab isn’t focused and browser notifications are granted — raises a desktop notification for each new alert. Until data arrives it shows “Waiting for alerts…”.

---

📸 Screenshots to capture

Capture these from the running app and save them to opennvr-site/public/screenshots/ with the exact filenames below:

• alerts-incidents-overview.png — the Alerts & Incidents table populated with alerts, the severity filter buttons visible, and the “Showing N alerts” counter.
• alerts-incidents-category-filter.png — the table with a Category: … × chip active, showing a category-filtered view.
• alerts-detected-anomalies-stream.png — the live Detected Anomalies stream (on the AI Engine view) with a few rows and the Mark all as read button.