SaaS Alerts MSP Admin guide

At the top of the Dashboard page, you will see Setup and Release Notes information.

The bottom of the page displays a map showing the Last known connection points based on the last 10,000 connection points. The map represents all your organizations' activity in the last seven days.

This page provides a quick overview of the organizations with the most tickets created.

Selecting an organizations from the list will hide it from the chart.

This page displays Apps by User Connections and Apps by Critical Alerts.

Here, you can view the most recent critical, medium, and low alerts. The list of the last 100 alerts is updated every 60 seconds. You can filter the results using the drop-down menus at the top of the page.

Here, you can search and view alerts that are suppressed. You can also view when a suppression expires as well as release a suppression.

To add a new customer, click New Organization in the upper-right corner of the page.

Fields with a red asterisk indicate required information. It is necessary to select at least one country, IP address, or range of addresses to successfully create an organization.

Click Add Application to begin the process of adding a SaaS application connection.

If you have the customer's global admin credentials, you can select I have customer's global admin credentials.

If you do not have credentials, select I want my customer to create the connection.  This self-onboarding option provides the ability to either have SaaS Alerts email the domain admin or copy the link so the email can be sent personally.

NOTE  Disable pop-up blockers so SaaS Alerts can authenticate to each app being monitored.  

Once these steps have been completed, the new customer will have been successfully added to the list.

This tab is where your business information is listed, including billing information and payment methods.

This tab is where you can add, remove, and update users with access to SaaS Alerts. You can filter on Status, Email, or MFA Enabled.

• Clicking the pencil icon allows you to edit a user account.
• Clicking the lock icon indicates if the account is active or not.
• Clicking the trash icon will delete an MSP User account (an MSP Admin account first has to be demoted to an MSP User account to be deleted).
• Clicking Export All Users will export the user list to a spreadsheet in CSV format.
  

This tab is where you can add a PSA or email notification.

To add a PSA, click Add PSA.

Select the PSA you would like to add and enter the relevant information.

To add email notifications, click Add Email and add an email address.

This tab allows you to customize alert severity, which can be set to Low, Medium, or Critical.  

This list of alerts can also be exported for reference. 

Hovering over the i icon will display the list of applications relevant to the alert.

Changing the Rows per page selection at the bottom of the page will allow you to see the entire list.

NOTE  Only alerts with a Medium or Critical severity will generate an email or ticket.

To set up a SaaS Alerts Webhooks subscription, complete the following steps:

1. To add a domain for subscription authorization, click the Add new domain icon .
   
   
2. Enter a valid domain you will use for creating subscription endpoints.

3. EXAMPLE  
   partnerdomain.com
   partnerdomain.com/path
   webhooks.partnerdomain.com



4. Click Add to submit the domain for validation and add the domain authorization for a SaaS Alerts Webhooks subscription if validation is successful. 

NOTE  Validation requires that, when queried, the domain returns a 2xx (typically 200) response indicating that it is live and can accept HTTP(s) requests. The domain host can have a blank page, API endpoint, or maybe the domain on which your primary website exists.

IMPORTANT  The domain must match the location of your webhook endpoint. 

The domain validation process will produce either of the following results:

• Domain validation succeeded 
• Domain validation failed - unable to reach the specified domain

For more information, refer to Webhooks (API documentation).

This tab allows you to enable role-based access control (RBAC), Group Access.

IMPORTANT  RBAC requires at least two organizations to be connected to the platform and at least one non-MSP Admin account (MSP User). If no MSP User accounts are present, one will need to be created or an MSP Admin demoted to MSP User first for RBAC to function as expected.

1. Turn on the toggle to enable RBAC/group access.
2. Click the Add new Group icon .
   
3. Enter a Group Name and select Organization(s) and User(s).
   

NOTE  If the Create New Group option remains grayed out after selecting Select all users, it means no MSP Users exist in your partner instance. RBAC works only on non MSP Admin accounts. Creating a new MSP User account or demoting an existing MSP Admin account will allow you to create a group as expected.

For more information, refer to Role-based access control (RBAC) group access.

Based on the dates selected, Worldwide Risk Events for all organizations are displayed on the map. Events are updated every five seconds capturing data from the last 24 hours.

SaaS Alerts provides a list of predefined reports listed in three categories:

• Executive Reports
• Operational Reports
• Configuration Reports
  

The Report module allows partners to customize report schedules for each customer. You will see any existing scheduled reports on the main Scheduled Reports page.

Creating a new scheduled report

1. Click New Schedule to create a new report schedule.
   
2. Select the Schedule Type: Recurring to send a report regularly at a set interval or One Time to send an ad-hoc report on a future date.
3. Select the Frequency at which the report should run.
   

NOTE  Choosing Recurring will send the report at the beginning of the preferred frequency at 12:00 AM UTC time zone.

EXAMPLE  Scheduled weekly reports will be sent every Monday at 12:00 AM UTC.

4. Report Details: Reports are listed in two categories, Organization and MSP Only.
5. Select the report(s) you would like for the customer organization.
   
6. Select the Organization you would like to report on.
   
7. Select the Recipients you would like to have report(s) emailed to.
8. Click Save when finished.
   

Branding allows you to upload a logo to be used in reports and dashboards.

For image branding to be successful, follow the guidelines in terms of file size and image format.

After the Respond permissions requirements are accepted, you will land on the Rules page. From here, you will be able to create a new rule, manage existing rules, or turn off the Respond module completely.

Creating a rule

Before creating a rule, it's important to understand how rules are structured. Rules apply to one or more organizations, at least one account (typically a user account), and must be listening for at least one event. Rules can then have responses, or actions, that are taken if the rule conditions are observed triggering the response. Refer to Respond actions.

It is possible to select a no-action, which is the equivalent of creating a new SaaS Alerts event. The anatomy of a rule can be described as observed event(s) for customer organization(s) and SaaS Application account(s) that trigger actions selected by the MSP Admin to perform automated response(s). 

Steps

1. From the Rules page, click New Rule.
2. Click Untitled Rule to edit the name of the new rule.
3. Select Events to create the Respond rule.
4. In the Trigger section, select the application to be monitored. Currently, only Microsoft 365 can be selected. Next, select Organizations and Accounts.
   
5. Select the Organizations and Accountsto be monitored. You have the option to select one, all, or multiple organizations and accounts.