Alerts and triage

The queue

Alerts is a single triage queue across every client tenant, newest first, with the severity, title, tenant and status on each row. Suspicious verdicts arrive as medium, malicious as critical; scans and incidents can also raise alerts.

Working an alert

1. 1Click Ack to take ownership — the alert moves to acknowledged so another technician does not duplicate your work.
2. 2Investigate the underlying threat, using the AI Threat Analyst chat if you need context.
3. 3Escalate to an incident if containment is required.
4. 4Click Resolve when the action is complete. The resolution time is stamped and feeds the MTTR figure in the SOC report.

Keeping the queue healthy

Resolve or escalate everything within your SLA window. A queue full of stale open alerts distorts your reported response times and hides the alert that actually matters.