Detections, Alerts & Incidents
Last updated
This is the core detection-to-response flow. Detection rules evaluate incoming telemetry and logs and raise alerts; related alerts are then correlated into incidents that your SOC investigates and acts on.
Detection rules run continuously over the data your agents send.
A rule that matches raises an alert — with a severity, the rule that fired and the host or entity involved.
Related alerts are correlated into an incident, so analysts work one consolidated case instead of many isolated alerts.
Opening an incident gives you everything needed to understand and respond to it.
An AI-generated investigation explains what happened in plain language — the likely sequence of events and what to do next — so you can triage faster.
A chronological timeline of the events that make up the incident, so you can see how the activity unfolded.
The process activity collected from the host (the Activity telemetry) lets you trace which process spawned which — useful for following an attack from its entry point through to its actions.
Activity in the incident is mapped to MITRE ATT&CK techniques and tactics, giving you a standard frame of reference for what the adversary was attempting.
From an incident you can run response actions against the affected host — for example Isolate it, Collect Triage or Quarantine File. Containment steps such as Block C2 (pushing a block rule to a firewall integration) are driven through automated response playbooks.
You can raise a Jira ticket from an incident to hand it off to another team or track remediation in your existing workflow. The ticket is created in your configured Jira project.
Last updated