The following article describes the chain of events following an incident that occurs on an endpoint protected by the Cynet agent.Customers who purchased Cynet 360 via MSP/MSSP: All interaction with CyOps is via your MSP/MSSP.Alert TriggeringWhen Cynet recognizes a potentially malicious action, an alert is trigged in the Cynet 360 console. The alert type and severity are determined by the various detection rules, which are constantly created and updated to uncover new threats. By default, only critical and high severity alerts, that are in status Open, are displayed in the Alert page. You can easily change the display to include other severities or statuses.Critical alert: A security incident that indicated malicious activity and requires immediate mitigation. CyOps contacts the customer within one hour.High severity alert: Any cyber security event that requires the attention of the customer’s security personnel.Alert EmailsYou can configure Cynet 360 to send alerts by email to specified recipients. This can help you to keep track of alerts and events that require a response, without going into the Cynet 360 console. You can filter which alerts are sent by the severity level of the alert. To update the list of email recipients, contact your technical account manager.Different mechanisms determine if an alert is identical or similar to another, recently triggered, alert. Identical alerts are aggregated to appear only once in the Cynet 360 console and corresponding email.Interaction with CyOps The CyOps team monitors critical and high severity alerts only. The CyOps team contacts a customer ASAP via telephone only if there is reason to believe that a triggered alert or discovered artifacts in your environment require an Incident Response. Any follow-up communication will be performed via the ticketing system. Cases in which the CyOps team contacts customers via email are: Advise and assist with alert whitelistingPenetration tests performed by the customerReply with file verdict to Send to SOC Analysis action, performed from the consoleAddress cases opened via the ticketing systemClosing AlertsWhen alert management is complete, it is the responsibility of the customer to close the alert.