| Block | Input | Output |
|---|---|---|
| Enrich | Entities on the alert | Reputation and context for addresses, hashes, users and domains from the configured enrichment services and the threat intelligence store. |
| Correlate | The alert | Related alerts and events across sources and time, and the correlation the alert belongs to. |
| Query telemetry | A saved query with alert fields as parameters | Rows, attached to the run. |
| AI investigate | The alert and what earlier blocks gathered | Additional context from bounded read-only queries, each listed. |
| Collect file | A path on the alert's host | The file, stored as evidence. |
| Similar-alert history | The alert's rule and entity | How alerts like this one were dispositioned before, and how fast. |
| Compare | Gathered facts, a pattern | Match or no match, with the facts that decided it. |
| Branch / gate | A condition on any earlier output | Continues on one path, or stops. |
| Run workflow | Another playbook | That playbook's outputs. |
| Advisory verdict | Everything gathered | Verdict, confidence, recommendation, evidence grade, summary. |
| Triage note | The verdict and facts | A note written into the alert, marked as AI-written when a model produced it. |
| Stage response | An action and its target | In pre-stage mode, a staged action awaiting confirmation; in auto mode, an executed action when the verdict and ceiling allow. |
| Notify / ticket | A channel and a message template | A delivered notification or an opened ticket. |
Outcomes
A playbook ends in one of: send to the analyst queue (the default), recommend close, escalate to a case, or isolate the host. Recommend close and escalate act only in auto mode with a confident verdict; in pre-stage mode they are shown as recommendations.