> ## Documentation Index
> Fetch the complete documentation index at: https://docs.protectorplus.cloudsine.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat Management

> Alerts, dashboards, and forwarding to your SIEM.

## Alerts page

The Alerts page lists violations detected by the guardrails. Alerts are tagged:

* **Detected** — produced by guardrails operating in Monitor mode or detections made via Non-forwarding mode.
* **Blocked** — prompts dropped by guardrails in Block mode during in-line deployment.

Each alert exposes the prompt, the guardrail decisions, per-layer scores, and any operator action taken. Click the alert's ID to open the drill-down view.

## Exporting alerts

Click **Generate CSV** at the top of the Alerts page to export the current alert set.

## Dashboard summary

The **Dashboard** page provides a quick overview — total alerts, top guardrails firing, timeline views, and per-application breakdowns.

## SIEM forwarding

Alerts can be forwarded to an external log collector. Protector Plus currently supports **SYSLOG-over-UDP**.

<Steps>
  <Step title="Open SIEM Integration">
    Left-hand panel → SIEM Integration.
  </Step>

  <Step title="Enter the collector address">
    Provide the IP address and UDP port of your log collector.
  </Step>

  <Step title="Enable forwarding">
    Toggle the forwarding switch on.
  </Step>

  <Step title="Save">
    Save the settings. Events begin flowing immediately.
  </Step>
</Steps>

<Note>
  SIEM-forwarding configuration is restricted to **Super Admin** users only.
</Note>

## What gets forwarded

| Event class              | Description                                                               |
| ------------------------ | ------------------------------------------------------------------------- |
| Dashboard login activity | Authentication events for the management console.                         |
| Security events          | Per-request guardrail decisions, including Detected and Blocked outcomes. |

All events, regardless of deployment mode or application profile, can be forwarded to a single SIEM destination.