Defining threat levels

2026-02-13Last updated

To help your security personnel respond quickly to a specific scenario, you can define a threat level.

What you should know

CAUTION:
The system does not clear a threat level automatically. Explicitly define the actions that are triggered when the scenario ends.

Procedure

  1. Open the System task. In General settings, click the Threat levels tab.
  2. At the bottom of the threat level list, click Add an item ().
  3. In the Threat level configuration dialog box, enter the Name, Description, Logical ID (optional), and Color of the threat level.
    Tip:
    Select a unique color for each threat level.
  4. Configure the threat level Activation actions.
    The system performs these actions when the threat level is set, regardless of the user’s privileges and permissions.
  5. Configure the threat level Deactivation actions.
    The system triggers these actions when the threat level is cleared or replaced by another, regardless of the user's privileges and permissions.
  6. Click OK.
    A new threat level () appears on the threat level list.
  7. Click Apply.

After you finish

Ensure that all users who need to set threat levels have the required privileges. For privilege requirements, see About threat levels in Security Center SaaS.
  • To check which threat level and security clearance are assigned to each area, use the System status task.
  • To find out when threat levels were set and cleared, and by whom, use the Activity trails task.