The alert queue
Triage alerts from the keyboard, with a reason recorded for every dismissal and a deadline on every severe alert.
Every alert the platform raises lands in the Alert Queue. Each one carries its evidence (the event and the rule matches behind it), its MITRE ATT&CK techniques, a risk score from 0 to 100, and the count of times the same signal has repeated.
One alert per signal, not per event
Section titled “One alert per signal, not per event”The same rule firing on the same entity within an hour raises the count on the open alert instead of opening a new one. A vulnerability found on a host stays one alert for as long as it is open, however often a scan reports it again. Once an alert is resolved or dismissed, the next occurrence opens a new one.
Statuses
Section titled “Statuses”New alerts arrive as Open. From there they move only along these paths:
| From | Can move to |
|---|---|
| Open | In progress, Confirmed, Dismissed, Escalated, Resolved |
| In progress | Confirmed, Dismissed, Escalated, Resolved |
| Confirmed | Resolved, Escalated, Dismissed |
| Dismissed | Confirmed, Open |
| Escalated | Resolved, Confirmed |
| Resolved | — (final) |
Every change is written to the alert’s own audit trail with who made it and why.
Dismissing requires a reason. Choose a category — known tool, approved scan, test activity, rule logic too broad, or other — and write a sentence. Dismissals and confirmations are counted against the rule that fired, so a noisy rule shows up in the rule metrics.
Escalating opens an investigation for the alert automatically, unless one is already linked.
Keyboard
Section titled “Keyboard”| Key | Does |
|---|---|
| J / ↓, K / ↑ | Next / previous alert |
| C | Confirm as a true positive |
| D | Dismiss — opens the reason dialog |
| E | Escalate to an investigation |
| A | Assign to me |
| R | Run the AI analysis again |
| / | Search |
| Esc | Close the alert |
While a dialog is open, the keys act on the dialog only, never on the alert behind it.
Deadlines
Section titled “Deadlines”Severe alerts carry a deadline for triage, counted from when the alert was raised:
| Severity | Triage within |
|---|---|
| Critical | 4 hours |
| High | 24 hours |
| Medium | 72 hours |
| Low | 7 days |
| Info | no deadline |
The clock stops when the alert is resolved or dismissed. The SLA Breached tab lists the alerts past their deadline.
Teams and saved views
Section titled “Teams and saved views”Each alert is routed to a team from the rule that raised it: Identity & Access (authentication, Active Directory, lateral movement), Endpoint & Malware, Network & C2, Intrusion Response (unauthorised access found on a monitored server) or General SOC for the rest. The team is worked out when the queue is read, so it applies to old alerts too.
A set of filters can be saved as a view. Views are your own unless you share them with the tenant; only their owner can delete them.