Aggregated Alerts and Rule Groups

Rule Groups allow detection rules to be configured together so that when multiple rules within the same group fire against the same entity, the resulting alerts are consolidated into a single Aggregated Alert. This gives investigators a complete view of connected suspicious activity within one investigation workflow.

Aggregated Alerts are identified by a dedicated icon in the Alerts Dashboard, with the Business Rule column displaying the Rule Group Name and the number of rules triggered. On the Aggregated Alert Assessment page, investigators can review the combined score, a full breakdown of triggered rules in the Business Rule Group section, and use a quick filter on the transaction grid to focus on the activity relevant to each individual rule.

User Guide Reference: Transaction Monitoring Investigations