Office 365 high severity alert
A high severity alert lands at 02:14. Here is what you know by 02:20.
In most tenants a high severity alert is a subject line and a dashboard link, and the first hour goes to re-collecting context from four different places. In 1Security the alert arrives with which policy fired, which account, how far today is from that account's own 30-day normal, which device and which place - and one click lands on the exact events behind the number. Most alerts close in minutes. The ones that do not get escalated with evidence.
The problem
The alert is one line. The investigation is four screens and an hour.
The worst minutes of alert response are spent re-collecting context: which account is this, what can it reach, is 400 downloads unusual for it, is the machine behind it one of ours, and where in the world was it. Each answer usually lives somewhere else - permissions in one place, sign-ins in another, mailbox access in a third, activity history in a fourth. The clock runs while you collect.
Volume makes it worse. A single unfolding incident that mails you once per event produces forty emails about one problem, and a team that gets forty emails learns to filter the sender. In a typical tenant the large majority of high severity alerts close as benign once someone finally looks - which is exactly why the one that is not benign gets the same tired glance.
What changes the outcome is not a better subject line. It is arriving with the four answers already attached, so the verdict takes minutes and the fix is on the same screen.
In practice
From the mail to the fix, on one screen.
What the minutes after a high severity alert look like in 1Security.
- 01
The mail arrives with the why
The instant channel sends it the moment the line is crossed: the policy, the account, "412 downloads today against a usual 9", the device and the origin (city, network type, first seen or not). A per-episode cooldown means this is one mail, not forty. Activity reaches the engine within about ten minutes of happening, so the alert fires while the incident is still going.
- 02
Open the episode, not a scatter of events
In Anomalies the alert is an episode: it tracks the peak while the behaviour continues and records when the metric returned to normal. A 30-day sparkline shows at a glance whether this account does this every quarter-end or has never done it before.
- 03
One click to the evidence
The number in the alert links to the exact rows in Activity logs that produced it - each attributed to the actor, the file or mailbox, the app, the device and the location, with the raw record one click deeper. Then the account's drawer answers the last question: what else can this account reach, across every site, group, link and mailbox delegate.
- 04
Stage the fix, do not improvise it
From the same screen: revoke the sharing links, remove the access, disable the account. Actions stage behind a review window (72 hours by default, instant when you choose) and land in Actions as evidence of what was done, by whom, when. If the verdict is benign, acknowledge the episode and it is out of the queue.
What makes it work
Three parts of the platform, one alert.
This is not an alerting add-on. It is the same engine and permission graph the whole platform runs on.
Alerts with the why attached
One alert model across trends, activities, anomalies and automations - instant and digest channels, episodes instead of event spam, and a sensitivity dial that re-answers against your real history the moment you move it.
See the feature →Near-real-time monitoring
Activity lands in the engine within about ten minutes at any tenant size, and one-hour windows are read straight from raw audit logs - the alert fires while the incident is still unfolding, not the next morning.
See the feature →Three years of memory
Every event behind the alert is attributed and retained for up to three years on a standard license, so "is this normal for them?" is a lookup, not a log-stitching project.
See the feature →
FAQ
Common questions.
Will every alert send an email?
No. Instant alerts ride the real-time path with a per-episode cooldown, and digests collect everything that can wait onto the interval and recipients you choose. One incident is one message, not a mailbox full. Anything below the alert line is kept as Info - stored, never mailed, one toggle away.
Do Microsoft Defender alerts show up here too?
Yes. Defender and Sentinel alerts land in the same list, already linked to the users, groups, emails and apps 1Security matched them to - so the pivot from a Defender alert to "what can this account reach and what did it touch" is the same one click.
Can the response run without a human?
Only if you choose that. Automated actions stage a per-resource proposal behind a grace window (72 hours by default, instant, 24 hours and 7 days as presets) where you approve, reject or let it proceed - and everything lands in Actions either way. The base connection is read-only; write actions are a module you enable separately.
How long until the alerts are meaningful?
Threshold alerts work from the first sync. Baseline anomalies stay quiet for the first 14 days on purpose, so the first ones you get compare against a real normal. No E5 and no Entra P2 are needed.
Stop triaging subject lines.
Connect read-only and see the next high severity alert arrive with its policy, account, baseline, device and origin already attached - and the fix one review away.
Or keep rebuilding context by hand, one screen at a time.