Overview

Interno does not push automatic "insight" cards at you. Instead you decide what is worth being told about, and Interno tells you on a schedule.

There are three things in Interno that together give you early warning on risk:

This guide shows how to use each of them. It replaces earlier guidance describing an automatic "Insights" panel on the Dashboard — there is no such panel.

Prerequisites

• At least one integration connected and syncing, so there is data to query
• defence:query:view to open the Query Library
• defence:query:create to create an alert, and defence:query:execute to trigger one manually
• defence:risk:view to open the Risk Register, defence:risk:create to raise a risk and defence:risk:manage to work it

1. Set up a scheduled alert

Scheduled alerts are the closest thing Interno has to a proactive notification.

Navigation: Sidebar → Assets → Query Library → Alert tab

1. In the sidebar, expand Assets and click Query Library.
2. Select the Alert tab.
3. Click Create Alert. The Query Builder opens.
4. Build your query on the Query tab (pick a source and the fields you want), or write it yourself on the SQL tab. The AI tab lets you describe what you want in plain language.
5. Click Create Alert. A form appears.
6. Fill in:

• Title (required)
• Description (required, up to 500 words) — this text is included in the alert email
• Users (required) — the people who receive the email
• Interval (In Day/Days) (required) — a whole number greater than 0

1. Click Create.

The alert now runs on that interval. Each run executes the query and emails the recipients with the subject Alert: <your title>, containing the title, the description and the results as a table. The email is sent on every run, whether or not the query returned rows.

An alert cannot be created if the preview returns more than 100 rows. The Create Alert button stays disabled and an information icon explains: "You have selected more than 100 rows, make sure total number of rows is less than 100." Narrow the query with a filter or a limit.

Reading the Alert list

Use the search box to find an alert by name.

Running an alert now

1. On the Alert tab, open the row's action menu.
2. Click Trigger.
3. Confirm on the Trigger Confirmation dialog by clicking Trigger.

The alert executes immediately and the email goes out. This does not change the schedule.

The same action menu also offers Edit (confirm, then the Query Builder reopens for that alert) and Delete.

2. Track what you find in the Risk Register

When an alert or your own analysis turns up something that needs owning, record it as a risk.

Navigation: Sidebar → Risk Register

1. Click Risk Register in the sidebar.
2. Click Create Risk.
3. Complete Risk Name, Description, Assignee, Choose Connector and Due Date — all are required.
4. Click Create.

The Create Risk button needs defence:risk:create. Open the risk to work it through the four-step lifecycle, which needs defence:risk:manage. See How to Use the Risk Register for the full walkthrough.

3. Ask ZIN Advisor

On Zeron's cloud platform the sidebar has a ZIN Advisor entry that opens a chat. Use it to ask questions about your environment in plain language and to follow up on something an alert reported.

ZIN Advisor answers when you ask. It does not send you unprompted findings.

If you do not see ZIN Advisor in the sidebar, your Interno is an on-premises deployment, where that entry is not present.

4. Know when a scan fails

Interno does tell you one thing unprompted: the person who added an integration is emailed when a scan of it starts, completes or fails. A failed scan also outlines that credential's card in red in the tool's panel under Admin → Integrations. See How to Configure Connectors/Integrations.

Troubleshooting

I was told there is an Insights or Alerts panel on the Dashboard → There is not. Proactive notification in Interno is done with scheduled alerts in the Query Library.

The Create Alert button is missing → Creating alerts requires defence:query:create. Ask your administrator to add it.

Trigger or Edit fails with a permissions error → Triggering an alert requires defence:query:execute, and saving an edited alert requires defence:query:update. These are separate from defence:query:create, so a user who can create alerts may still be unable to run or update them.

Recipients are not getting the email → Check the Users list on the alert. If no users are selected, the alert still runs but no email is sent.

The alert email arrives with an empty result table → The alert emails on every run regardless of results. An empty table means the query matched nothing this cycle.

My sidebar items are greyed out → Until your organisation has ingested data, only Integrations, Management, Manual Ingestion and Settings are usable. Connect an integration or upload data through Manual Ingestion first.

Need more help? Contact support@zeron.one