A self-hosted alert review tool for MSPs to review 343 MDR alerts with team collaboration and automatic Airtable sync.
Status: ✅ Complete
Built a functional alert review tool with localStorage sync and Airtable integration. 343 alerts with before/after diffs, team feedback, filtering, and review tracking.
Status: ✅ Complete
Fixed garbled emoji characters by converting from UTF-8 to HTML entities. Ensures reliable rendering across all browsers and file encoding scenarios.
Status: ✅ Complete
Enhanced visual hierarchy with vibrant colors, clear "Changes:" labels, improved button styling with hover effects, and better visual connection between filters and alert badges.
Status: ✅ Complete
Created comprehensive documentation (SUMMARY, ALERT_IMPROVEMENTS, CHANGES) and maintenance protocols for future development.
Documentation of improvements made to the 343 MDR alerts organized by cluster/group.
| Group | Alerts | Focus | Status |
|---|---|---|---|
| Worst-first gaps | 12 | Source-specific remediation improvements | ✅ |
| Generic boilerplate | 42 | Core alert remediation rewrite | ✅ |
| Cross-vendor duplicates | 15 | Differentiate duplicate-title families | ✅ |
| Identity & Access | ~87 | Cluster-wide review & standardization | ✅ |
| Windows/Sysmon | ~128 | Event log cluster review | ✅ |
| Network/Perimeter | ~74 | MITRE ATT&CK reference backfill | ✅ |
| Email & SaaS | ~47 | Collaboration cluster review | ✅ |
| EDR & Misc | ~26 | Long-tail endpoint detection cleanup | ✅ |
| Data hygiene | ~106 | Source field standardization | ✅ |
| MITRE validation | All 343 | Validate all IDs against live STIX | ✅ |
The following 275 alerts were excluded from this review cycle and remain in their original form:
| Category | Count | Details | Status |
|---|---|---|---|
| Uncategorized & Vendor-Specific | 275 | Includes mobile alerts (NG80xxx/NG82xxx), platform-specific alerts, and unstructured entries | ⏸️ Deferred |
Note: All 618 alerts (including the 275 excluded) are available in the Full Catalog. Future phases may address these uncategorized and vendor-specific alerts.
Complete record of all changes made to the alert review tool, including design decisions and rationale.
Fixed garbled emoji characters by converting from literal UTF-8 to HTML entities. Ensures reliable rendering across browsers and file encoding issues.
Entities used: ✓ (✓) ⚠ (⚠) ✕ (✕) 👤 (👤) · (·) ▶ (▶)
Upgraded from muted pastels to vibrant semantic colors using CSS variables. Better visibility and dark mode support.
Colors: Remediation (green) | References (cyan) | Source (yellow) | Triggers (red)
Added "CHANGES:" labels and improved button styling with borders, rounded corners, and hover effects. Creates clear visual connection between filters and alert badges.
Created three complementary documentation files (SUMMARY, ALERT_IMPROVEMENTS, CHANGES) and self-hosted documentation viewer. Enables future AI assistants to understand design constraints and avoid breaking changes.
Important: Always update CHANGES.md when making changes to this project. This documentation serves as a reference for future developers and AI assistants to understand the reasoning behind each decision.