| Block | Input | Output |
|---|---|---|
| Enrich | Entities on the alert | Reputation and context for addresses, hashes, users and domains from the configured enrichment services and the threat intelligence store. |
| Correlate | The alert | Related alerts and events across sources and time, and the correlation the alert belongs to. |
| Query telemetry | A read-only query over logs, alerts, cases or hosts, limited to the alert's organization | Up to 100 rows, attached to the run. |
| AI investigate | The alert and what earlier blocks gathered | Additional context from bounded read-only queries, each listed. |
| Collect file | A file on the alert's host, by target or exact path | The file and its SHA-256, under Response › Collected files. |
| Similar-alert history | The alert's rule and entity | How alerts like this one were dispositioned before, and how fast. |
| Compare | Gathered facts, a pattern | Match or no match, with the facts that decided it. |
| Branch / gate | A condition on any earlier output | Continues on one path, or stops. |
| Run workflow | Another playbook | That playbook's outputs. |
| Advisory verdict | Everything gathered | Verdict, confidence, recommendation, evidence grade, summary. |
| Triage note | Everything gathered | A short note pinned to the alert. Needs an AI model. |
| Stage response | An action, a provider and a mode | In pre-stage mode, a proposed action; in auto mode, an executed action when the verdict and guardrails allow. |
| Notify / ticket | An egress destination | A delivered message or an opened ticket. |
Outcomes
A playbook ends in one of: send to the analyst queue (the default), recommend close, escalate to a case, or prepare host isolation for an analyst to confirm. Close and escalate happen automatically only on a verdict of at least 80 percent confidence, and only where the organization's guardrails allow; otherwise they are shown as recommendations.