> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/detections-alerts-incidents.md).

# Detections, Alerts & Incidents

This is the core detection-to-response flow. Detection rules evaluate incoming telemetry and logs and raise alerts; related alerts are then correlated into incidents that your SOC investigates and acts on.

## From detection to incident

1. **Detection rules** run continuously over the data your agents send.
2. A rule that matches raises an **alert** — with a severity, the rule that fired and the host or entity involved.
3. Related alerts are **correlated into an incident**, so analysts work one consolidated case instead of many isolated alerts.

## Incident detail

Opening an incident gives you everything needed to understand and respond to it.

### AI investigation

An AI-generated investigation explains what happened in plain language — the likely sequence of events and what to do next — so you can triage faster.

### Attack timeline

A chronological timeline of the events that make up the incident, so you can see how the activity unfolded.

### Process tree

The process activity collected from the host (the **Activity** telemetry) lets you trace which process spawned which — useful for following an attack from its entry point through to its actions.

### MITRE ATT\&CK

Activity in the incident is mapped to MITRE ATT\&CK techniques and tactics, giving you a standard frame of reference for what the adversary was attempting.

## Responding

From an incident you can run [response actions](/user-docs/10-siem-edr-xdr/response-actions.md) against the affected host — for example **Isolate** it, **Collect Triage** or **Quarantine File**. Containment steps such as **Block C2** (pushing a block rule to a firewall integration) are driven through automated response playbooks.

## Create a Jira ticket

You can raise a Jira ticket from an incident to hand it off to another team or track remediation in your existing workflow. The ticket is created in your configured Jira project.