Detections and alert triage
Review observations, correlate related activity, suppress noise deliberately, and preserve original events.
Detections record security-relevant observations from edge services, agents, scanners, gateways, or intelligence matching. Their lifecycle is separate from incident resolution and response execution.
Review a detection
At Detections, filter by group, source, category, severity, and occurrence time. Open an item to inspect event ID, affected asset, source identity, applied rule revision, intelligence version, first/last observation, ingestion delay, and evidence availability. Severity describes the detection's urgency; it is not a confirmed compromise verdict.
An Analyst selects Acknowledge, assigns an owner, and records an initial assessment. Dispositions are unreviewed, investigating, confirmed, benign, or false_positive. A false-positive conclusion needs a reason. Changing disposition does not rewrite the raw observation or retract a notification already delivered.
Correlate activity
Use Detection → Link to incident to add the observation to an existing investigation or create one. Match stable asset and agent IDs, event time, rule context, and process or connection evidence. Shared IP addresses and repeated titles are insufficient proof of the same actor.
A grouped alert can summarize repeated events; its count and time range do not imply one underlying request. Reports and exports retain event IDs so downstream systems can deduplicate independently.
Reduce noise without hiding coverage
Use Detection → Tune rule to review the affected policy, or create a bounded exception. Detection suppression affects alert generation or routing according to its stated type; it does not necessarily stop telemetry collection or remove enforcement. Disabling a notification channel does not disable the underlying detector.
After tuning, verify the new revision and a benign test event. Review suppressed-event counts and expiring exceptions at Policies → Exceptions. Alert delivery status appears under Detection → Deliveries and is independent from the response action result.