The queue
Alerts shows alerts for the organizations in your scope. Filter with the query bar, the filters panel and the graphs above the list. Switch between the list and the board (new, assigned, investigating, review, closed). Set auto-refresh from the timer button next to the refresh control; the choice is kept on your device.
Columns include time, severity, the alert, the AI verdict, stage, SLA, assignee and age, and more can be added from the columns menu. The SLA column shows the time left to respond or resolve, coloured as it approaches the target.
Quick preview
Press o or Enter on a row to open the essentials in a drawer without leaving the queue: summary, verdict, first events, and the assign and stage controls. Double-click a row to open the full alert page.
The alert page
| Tab | What it holds |
|---|---|
| Details | Rule, entity, timestamps, tags and unusual baseline facts. |
| Event graph | Where the alert sits among hosts, users, processes and destinations. Right-click a node to expand it, pivot or act. |
| Process tree | For alerts with process activity, the parent chain and children, with what each process did. |
| Evidence | The matched events, with one click to the raw document in Logs. |
| ATT&CK | Technique and tactic. |
| AI workflow | The advisory verdict, its evidence grade and the steps the playbook ran. See Triage verdicts. |
| Contacts | Who to reach at the customer, and whether quiet hours apply right now. |
Investigation notes sit below the tabs.
Working an alert
- Assign it to yourself. The first triage action stops the respond clock.
- Investigate: read the verdict and its evidence grade, look at the graph, open the raw events.
- Act: carry out staged or new response actions from the host's page under Response.
- Close it with a disposition (true positive, false positive, benign or expected, duplicate), or create a case. A case carries the alert's notes, events, hosts and indicators over.
Closing stops the resolve clock. A rule that matches the same entity again in the same window never reopens or overwrites a closed alert.
Bulk actions
Select rows with Space or shift-click, then assign, add to a case, tag, run an AI workflow, create a case, or close them together. Closing requires a disposition.
Right-click
Every row has a context menu: preview, open, assign, tags, create or add to a case, run an AI workflow, Suppress alerts like this… and Add rule exception…. The last two open pre-filled with the alert's rule and entity. See Exceptions and suppressions.