Adding a user has never been simpler. Just click username on the top right bar and select Settings from the menu.

Then click on "ADD USER" and fill in all the fields, you can also Delete or Edit Users in this Section. Please keep in mind that the actual username has to be an email address.

ACSIA enables you to create distribution lists where you can add members to each group and set the notification types to be sent to each distribution list. For instance, you can set a distribution list to receive only Critical or High or Medium/Low priority security alerts. Your C-Level management may not want to receive alerts outside Critical events and therefore a distribution list can be created to satisfy this requirement.

You will find the Distribution List on the left sidebar menu. To create a new distribution list just click "ADD NEW LIST".

Give a name to the Distribution List created and select the members by adding them to the list along with choosing the type of event (Critical, High or Medium/Low) that you wish the group should receive.

You are now all set to receive notifications through the distribution list.

The email settings relate to ACSIA server-side notifications via emails. This setting can be found at the top right under the Settings menu Email tab.

Here you can set the sender email and the name for it. For instance, if your organization's domain is called example.com you can set the email as no-reply@example.com and the name as Acsia Alerts and white list that accounts on your anti-spam filters to make sure you receive notifications from that email account.

As soon as you set this up you will start receiving notification emails as per the setup.

If you experience issues in receiving email the recommended action is to set up an actual real email account and configure Under the email notification, instead of setting a simple email and label, you can enable the SMTP and the Authentication methods where you can fill in the details of the email you wish to use as sender.

Similar to the email notification, you can also activate notifications to be received through Slack and/or Microsoft Teams. You can enable this in Settings section under integration where you can simply copy the desired webhook (Microsoft Teams or Slack) and activate it to receive notifications via real-time messaging.

With the kernel level monitoring, once enabled, ACSIA has the ability to intercept the stream of every system call made to the kernel by intercepting the `syscalls and searching for anomalies/threats in real-time (this is for Linux systems only).

If you’d like to receive kernel-level notification it is recommended to keep this feature enabled. It can be disabled at any time for those who wish to do so by navigating to Setting and click on Notification tab.

If you’d like ACSIA to handle the majority of threats originating from outside your organisation (i.e. attacks originating from the internet such as BotNet, Bruteforce, Dictionary, SQL injections, XSS attacks etc) then this feature must be enabled.

If enabled, ACSIA will automatically take remediation actions such as banning IP addresses on the spot. You can enable Automatic Ban by navigating in the Settings area and click on the tab Notification.

ACSIA by default cannot ban local IP addresses, this is to avoid any business interruption or similar incidents that will impact business. However, if you’d like to be able to ban local IP addresses you can do this by enabling this feature under the Settings→Notification tab.

ACSIA stores all incoming logs from servers between  OpenSearch and MySQL databases. The lifespan (retention period) of the logs can be configured by navigating to Settings and clicking on Log Retention tab.

ACSIA enables users to set the different retention periods for a different types of logs (which are listed below):

On the left side menu, we also have Live Notifications which contain a list of all live events that are not being actioned yet. All incoming security alerts will be listed in this section and by clicking on the Details arrow on each notification in this area you will be able to browse and explore the full details of a single incident/alert generated by ACSIA.

We also have filters where the events can be filtered and searched criteria based etc.

We have a Live Events sidebar on the right side of the screen. This sidebar is similar to Live Notifications with an exception of being static and permanently on the right side, this is useful when monitoring events while navigating through ACSIA’s functionalities.

Each event is shown with a short brief description along Immediate Actions to enable the user to action and remediate an incoming security event or incident on spot.

The IP Blacklist contains all those source IP addresses that have been marked as malicious and unauthorized and therefore blacklisted (banned by hosts). You can undo an action if an IP address is mistakenly banned by a user. If the autoban feature is enabled, ACSIA will automatically handle all potential attacks and threats originating from outside of the organization (from the internet for example) whereas internal threats will always be notified for the ACSIA administrator to make the final decision.

The IP Whitelist contains all those source IP addresses that have been marked as trusted. Note that whitelisting an IP address does not include web requests due to giving sensitivity to web application level accesses. Therefore when you white list an IP address that doesn’t apply to web requests and if traffic originating from that specific IP address identifies a potential threat it will be subject to notification and alert.

The Locked Users contains specific users that are marked to be locked. They can be legitimate users who attempt to gain access to non-authorized areas. Alternatively, they may be malicious users that have compromised the legitimate account details of a user and therefore been locked. ACSIA does not automatically block legitimate users, it always requires user input so it will be at the ACSIA administrator’s discretion to make that call.

The Access Location refers to those security events where legitimate access originates from a geographical location or an IP address that wasn’t authorized on ACSIA. Therefore waiting for approval, to be authorized or unauthorized. If you authorize a location-based IP address for a user it is like whitelisting that user only for that IP address. On the other hand, if you mark a user unauthorized, that user will still be able to access and make attempts but you will be notified every time. So the Access Location is different from blacklisting an IP unless you add the IP manually to the blacklist.

The Muted Notifications refers to those security events that have been acknowledged legitimately by ACSIA administrators and/or security analysts. Once an incident is marked to be muted ACSIA will no longer notify that type of incident. All muted events can be unmuted at any time.