Alert KB Review Hub

Documentation

×

📋 Project 📊 Alerts ⚙️ Changelog 📖 Full Catalog

Project Overview

A self-hosted alert review tool for MSPs to review 343 MDR alerts with team collaboration and automatic Airtable sync.

Key Features:

• View 343 alert diffs with before/after changes
• Local review persistence (browser localStorage)
• Airtable auto-sync (5-second polling)
• Team feedback display with timestamps
• Search & filter by ID, title, cluster, change type
• Mark reviews as Approved / Needs Review / Flagged
• Add notes to each review
• Dark mode support

Work Phases Completed:

1. Foundation & Core Features - Alert review tool with localStorage + Airtable sync
2. Emoji Encoding Fixes - Fixed garbled emoji by converting to HTML entities
3. UX Improvements - Vibrant colors, labels, hover effects for better clarity
4. Documentation - Comprehensive guides for future development

Alert Improvements by Group

343 alerts reviewed and improved across 10 major groups:

• Worst-first gaps (12) - Source-specific remediation improvements
• Generic boilerplate (42) - Complete remediation rewrites
• Cross-vendor duplicates (15) - Clarified confusing titles
• Identity & Access (~87) - Cluster standardization
• Windows/Sysmon (~128) - Event log standardization
• Network/Perimeter (~74) - MITRE reference backfill
• Email & SaaS (~47) - Collaboration tool improvements
• EDR & Misc (~26) - Long-tail cleanup
• Data hygiene (~106) - Source field standardization
• MITRE validation (343) - Framework verification

Quality Improvements:

• Remediation: From generic → specific, actionable guidance
• References: From incomplete → comprehensive MITRE mapping
• Sources: From blank → standardized attribution
• Consistency: From ad-hoc → cluster-wide standards

Technical Changelog

Recent changes made to the alert review tool:

Emoji Encoding Fixes

Fixed garbled emoji characters by converting from UTF-8 to HTML entities. Characters fixed: ✓ (checkmark), ⚠ (warning), ✕ (X), 👤 (person), · (dot), ▶ (chevron).

Change-Type Badge Colors

Upgraded from muted pastels to vibrant semantic colors: Remediation (green) | References (cyan) | Source (yellow) | Triggers (red).

Filter & Label Improvements

Added "CHANGES:" labels and improved button styling with better borders, corners, and hover effects.

Design Principles for Future Changes:

• Always use HTML entities for emoji (never literal characters)
• Keep all colors in CSS variables (for dark mode)
• Match Airtable field names exactly to user's schema
• Keep filter styling consistent with badges
• Test in both light and dark modes