Any alert shown on the Alerts page can be considered an alert class. Each time conditions exist that meet the triggering condition of that alert class, an alert instance occurs.
Some alert classes can have only one instance. For example, there is only one database for an Carbon Black App Control Server, and so the Database Limit alert can have only one instance at a time. For other classes, there can be many simultaneous instances. For example, there might be multiple malicious files on a network, so there could be multiple Malicious File Detected alert instances.
When any triggered instances of an alert class exists, the alert is highlighted on the Alerts page using the color-coded severity level, and a Reset button is added next to the alert name. The Date Triggered column shows when the alert was triggered, and the Instances column shows the number of triggered instances and links to the Alert Instances page. By default, triggered alerts display at the top of the page in descending order of when they were triggered. This display includes reset alerts.
The console does not display new banners for each alert instance during a console login session, but the number of instances is shown. The following image shows triggered alerts without grouping, and sorted by Date Triggered.
In addition, triggered alerts display on the Alerts portlet, which is on the default Home Page. A count of triggered alerts displays in the console banner.
