The queue
Alerts shows open alerts for the organizations in your scope. Switch between the list and the kanban board (new, assigned, investigating, review, closed). The list refreshes on the interval set in your personalisation, with a countdown you can pause.
Columns include severity, detection, entity, ATT&CK technique, stage, assignee, age and the SLA column: time remaining to acknowledge or resolve, coloured as it approaches the target. Sort by SLA when the queue is deep.
Quick preview
Press o or click the preview icon to open the essentials in a drawer without leaving the queue: summary, verdict, entity, first events, and the assign and stage controls.
The alert page
| Tab | What it holds |
|---|---|
| Details | Rule, entity, timestamps, tags, correlation membership, baseline panel. |
| Events | The matched events with one click to the raw document. |
| Graph | The event graph: where the alert sits among hosts, users, processes and destinations. Unfold any node. |
| Process tree | For process alerts, the parent chain and children, with what the process did next. |
| ATT&CK | Technique and tactic, with links to the coverage matrix. |
| AI | The advisory verdict, its evidence grade, the steps the workflow ran. See Triage verdicts. |
| Notes | Analyst notes, with @-mentions. |
| Response | Actions staged by the playbook and actions you can take on the host. |
Working an alert
- Assign to yourself (a). This acknowledges the alert and stops the acknowledge clock.
- Investigate: read the verdict and its evidence grade, look at the graph, open the raw events.
- Act: confirm staged responses or run your own from the Response tab.
- Disposition: close as benign, false positive, expected, or malicious; or escalate to case (e). Escalation carries notes, events, hosts and indicators into the case with no re-entry.
Closing stops the resolve clock. Re-detections of the same entity in the same window never reopen or overwrite a closed alert.
Bulk actions
Select rows with x to assign, tag, change stage or close in bulk. Bulk closes require a disposition and are audited individually.
Right-click
From any row: Suppress… and Add rule exception open pre-filled with the alert's rule and entity. See Exceptions and suppressions.