Security Alerting Rules & Routing UI

Quick answer

Security alerting UI lets Security teams define what becomes an alert, who gets paged, and when to suppress noise—not forward every log line to Slack. Design a rule catalog with trigger condition, severity, enabled state, and last-fired; rule builder with event type, thresholds, and geo/device filters; routing matrix mapping severity to channels (email, Slack, PagerDuty, SMS); on-call schedule overlay showing current responder; suppression and maintenance windows; and alert detail with timeline, linked audit events, and acknowledge/escalate actions. Start from the Figma guides hub and pair with suspicious login, incident runbooks, notification preferences, posture dashboard, and Dev Mode handoff.

Who this is for

Product designers building alert rule editors, routing configs, and on-call dashboards for enterprise Security, IT, and GRC admin consoles.
Design system teams aligning severity badges with badges, toasts, and inline alerts.
Engineers implementing rule evaluation, deduplication, escalation timers, and channel webhooks tied to webhooks infrastructure.

Rule catalog (admin hub)

AlertRuleCatalog
├── Header: Security alerting · [ New rule ] [ Routing policies ] [ On-call schedule ]
├── Summary: 38 active rules · 12 fired last 24h · 2 in suppression
├── Filters: Severity · Category · Status · Owner team
└── Row: Impossible travel login · Critical · Auth · Fired 3h ago · [ Edit ] [ Test ]

Column	Content
Rule name	Human-readable: “Impossible travel login”
Category	Auth, Access, Data, Network, Admin, Compliance
Severity	Critical / High / Medium / Low / Info
Trigger summary	”Login from new country within 1h of prior login”
Routing	Critical → PagerDuty + Slack #security-incidents
Status	Enabled / Disabled / Suppressed until Aug 1
Last fired	Timestamp + link to alert instance
Owner	Security team or rule author

Verdict: catalog answers “what can wake someone up?” at a glance—disabled and suppressed rules must be visually distinct from active.

Rule builder (trigger conditions)

RuleBuilder
├── Name: Bulk failed admin login attempts
├── Category: Auth · Severity: High
├── Trigger: Event type Login failed
├── Conditions:
│   ├── Role equals Org Admin OR Security Admin
│   ├── Count ≥ 5 within 10 minutes
│   ├── Same IP OR same username
│   └── Exclude: [IP allowlist](/designing-ip-allowlist-and-network-restrictions-ui-in-figma/) matches
├── Deduplication: One alert per username per hour
└── [ Save rule ] [ Send test event ]

Builder block	Examples
Event source	Login, API key use, elevation grant, DLP block, export job
Thresholds	Count, rate, unique actors, data volume
Filters	Role, env, sensitivity label, app ID
Exclusions	Maintenance window, known scanner IPs, test accounts
Deduplication	Prevent alert storms—key by user, IP, or resource

Use segmented controls for severity; combobox for event type search.

Test fire: “Send synthetic event” with preview of which channels would notify—no production page unless confirmed.

Severity tiers and routing matrix

RoutingMatrix
├── Critical → PagerDuty (immediate) + Slack #security-incidents + Email Security DL
├── High     → Slack #security-alerts + Email on-call rotation (15m delay if unacked)
├── Medium   → Slack #security-alerts · Daily digest email
├── Low      → Security dashboard only · Weekly summary
└── Info     → [Audit log](/designing-audit-log-and-security-activity-ui-in-figma/) only · No push

Severity	Response expectation	UI copy
Critical	Page on-call within 5m	Red badge, persistent banner option
High	Ack within 30m	Orange badge, Slack with action buttons
Medium	Review same business day	Yellow badge, queue in alert inbox
Low	Triage weekly	Gray badge, filterable backlog
Info	No human action	Logged only—do not route to PagerDuty

Per-rule override: advanced tab lets one rule bypass matrix (“Compliance export to personal email” always Critical).

Link member-facing notification preferences—admin rules override user opt-out for Critical security (disclose in policy UI).

On-call schedule and escalation

OnCallSchedule
├── Week of Jul 21: Primary Ana Liu · Secondary Marco Reyes
├── Override Jul 22 2–6 PM: DevOps bridge (maintenance)
├── Escalation: Unacked Critical after 10m → Secondary · after 20m → Security VP
└── [ Edit schedule ] [ Add override ]

Pattern	Implementation
Rotation calendar	Primary/secondary per week—use date picker for overrides
Escalation ladder	Time-based steps with ack deadline countdown on open alerts
Handoff notes	”Ana OOO Jul 24–26 — Marco primary” visible on schedule
External integration	PagerDuty/Opsgenie sync status badge
Quiet hours	Medium/Low defer to digest—not Critical

Show current on-call chip in alert detail header: “Paging Ana Liu (primary).”

Pair with incident runbooks—Critical alerts include deep link to playbook.

Alert instance detail (responder view)

AlertDetail
├── Title: Impossible travel login · Critical · Open 12m
├── Subject: jchen@acme.com · Login from BR after US login 28m prior
├── Timeline:
│   ├── 3:14 PM — Login success · São Paulo · New device
│   ├── 3:12 PM — Login success · Seattle · Known device
│   └── 3:15 PM — Rule fired · Notification sent PagerDuty + Slack
├── Linked: [Session](/designing-active-sessions-and-device-management-ui-in-figma/) · [Audit events](/designing-audit-log-and-security-activity-ui-in-figma/) · [User profile](/designing-avatars-and-user-profile-ui-in-figma/)
├── Actions: [ Acknowledge ] [ Escalate ] [ Resolve — false positive ] [ Open incident ]
└── SLA: Ack due in 18m · Escalates to secondary at 3:24 PM

Action	Result
Acknowledge	Stops escalation timer; assigns to responder
Resolve — false positive	Requires reason; optional “Tune rule” shortcut
Resolve — remediated	Link ticket; trigger account recovery if needed
Open incident	Creates INC record; links runbook
Suppress similar	1h / 24h / custom—for known maintenance

Use progress stepper for SLA: Open → Acked → Investigating → Resolved.

Suppression and maintenance windows

SuppressionWindow
├── Name: Q3 pen test · External vendor
├── Scope: All Auth rules OR selected: Bulk login failure, Scanner detection
├── Window: Jul 22 9 AM – Jul 24 5 PM UTC
├── Notify: Still log to audit · No PagerDuty · Slack #security-info only
└── [ Create ] [ Cancel ]

Use case	UI
Scheduled maintenance	Pre-create window; show banner in rule catalog
Pen test	Tag alerts with “Expected test activity” badge
Noisy rule tuning	Temporary suppress single rule while editing thresholds
Global kill switch	Break-glass disable all pages—requires break-glass elevation + audit

Expired suppressions auto-re-enable with toast to rule owners: “Suppression ended for Q3 pen test — 12 rules active.”

Prebuilt rule templates

Offer templates to reduce blank-builder friction:

Template	Default severity	Pairs with
Impossible travel login	Critical	Suspicious login
Mass permission export	High	Compliance exports
API key created without vault	Medium	Secrets vault post
JIT elevation denied spike	Medium	PAM policy review
DLP block burst	High	Data exfil runbook
SCIM sync failure	High	Directory admin
New OAuth app connection	Medium	App approval queue

Template picker uses cards with “Customize before enable.”

Posture and noise metrics

Feed alert health into security posture dashboard:

PostureGapCard — Alerting hygiene
├── 4 rules never fired in 90d (stale or wrong threshold?)
├── 18% of Critical alerts resolved as false positive (30d)
├── Mean time to ack Critical: 8m (target: 5m)
└── [ Review rules ] [ Open alert analytics ]

Analytics view: alerts by severity over time, top noisy rules, ack SLA trend—use tables and filter chips.

Common mistakes

Mistake	Why it hurts	Fix
Every event pages on-call	Alert fatigue; real incidents missed	Severity matrix + deduplication
No test fire	Rules break silently in production	Synthetic event preview
User opt-out blocks Critical	Miss breach notification	Admin override with policy disclosure
Suppression without scope	Pen test silences all auth alerts globally	Scoped windows + named rules
Alert with no linked context	Responder hunts in SIEM	Deep link audit, session, user
No false-positive feedback loop	Same bad rule fires weekly	Resolve reason + tune shortcut
Escalation without ack timer	Incidents sit unowned	Countdown + auto-escalate
Duplicate rules same trigger	Double pages	Duplicate detection on save
Low severity to PagerDuty	Noise at 3 AM	Enforce matrix defaults
No on-call override visibility	Pages wrong person	Schedule chip on every Critical alert

Recommended workflow

Design rule catalog with severity, category, status, and last-fired columns.
Build rule builder with event types, thresholds, exclusions, and deduplication.
Add routing matrix mapping severity to channels with per-rule override tab.
Create on-call schedule UI with overrides and escalation ladder.
Design alert detail page with timeline, linked entities, and ack/resolve/escalate.
Add suppression windows with scoped rule selection and expiry notices.
Wire template library and posture metrics; annotate SLA timers in Dev Mode.

FAQ

Member alerts vs admin security alerts?

Separate surfaces—suspicious login email to user is member-facing; this UI is admin Security ops routing.

Integrate with external SIEM?

Outbound webhooks on fire/resolve—mirror webhooks UI; show delivery status on alert timeline.

Alert on audit log tamper?

Yes — Critical template “Audit chain verification failed” with immediate page; no suppress without Security VP.

Contractors on on-call rotation?

Optional—many orgs restrict Critical ack to FTE; show eligibility in schedule editor tied to team roles.

Compliance retention for alert history?

Align with data retention—typically 1–7 years for Critical; export for compliance bundles.

Next steps

Design suspicious login alerts and account recovery UI in Figma — member-facing companion to admin rules
Design incident response runbooks and security playbooks UI in Figma — link from Critical alerts
Design audit log and security activity UI in Figma — event source for rule triggers
Design notification preferences and communication settings UI in Figma — member vs admin override policy
Design security posture dashboard and compliance checklist UI in Figma — alert hygiene KPIs

Designing security alerting rules and notification routing UI in Figma: triggers, channels, and handoff