The four parts
| Part | Meaning |
|---|---|
| Verdict | benign, malicious or inconclusive. |
| Confidence | A percentage. Automatic actions need at least 80 percent. |
| Recommendation | The next step: close, escalate, gather more or human review. |
| Evidence grade | How much of the evidence is the alert's own. A: the alert's own events. B: events for the alert's entity in its time window. C: nearby activity only. D: nothing gathered. On C and D a benign verdict is capped at 60 percent and needs human review. |
The grade exists because a confident verdict on thin evidence is the dangerous case. Read the grade before the summary.
The summary
Below the four parts is a short plain-language summary of what happened and why the verdict follows, with the evidence lines it relied on.
What the workflow ran
The AI workflow tab lists the steps the playbook ran before the verdict: enrichment lookups, correlation results, the investigation agent's queries. You can see exactly what the model was given.
Acting on it
- Rate the verdict with the thumbs on the alert page. Ratings feed the rule's agreement figure on the Detections page.
- Close or escalate with your own disposition. Dispositions that differ from the verdict count as disagreement.
- If agreement on a rule drops, auto-close and auto-escalate pause for that rule until it recovers.
Without a model
Without a configured model, or when the model call fails, the alert shows that no model assessed it. Nothing is closed or escalated automatically on such a run.