VERISCO Alertio Get started
VERISCO Alertio documentation
Alertio turns a high-volume stream of security detections into a short, explained worklist, and gives your team the tools to investigate and contain what it finds.
What Alertio does#
Your endpoints and sensors raise thousands of security detections a day. Most are routine, many are duplicates, and the few that signal a real attack look like everything else. Alertio decides which of them deserve a person's time, and shows why:
- every alert is deduplicated and scored from 0 to 100, with the calculation visible;
- related alerts are correlated into incidents and placed on a six-stage kill chain;
- analysts work one Triage Queue instead of the raw feed, and each alert in it states why it is there;
- investigation tools sit beside the evidence: threat intelligence, endpoint detail, MITRE ATT&CK coverage and AI analysis;
- response actions and playbooks reach the endpoint from the same console, previewed, confirmed and audited.
What it looks like#
Start here#
- Quickstart From your first sign-in to your first triaged alert.
- Core concepts Alerts, scores, the queue, incidents and the kill chain.
- Risk scoring How every alert gets its score, and how to tune it.
- Incidents How scattered alerts become one attack story.
- Response actions The eight actions, their risk, and who may run them.
- Troubleshooting Empty screens, missing alerts and failed actions.
Who does what#
Alertio has three roles. Each person's console shows only what their role allows, and the server enforces the same rules independently.
| Role | Typical user | Can |
|---|---|---|
| Administrator | SOC lead, platform owner | Everything: accounts, scoring, integrations, agents, playbooks and response scripts. |
| Analyst | SOC analyst | Triage alerts, work incidents, investigate, run AI analysis, and run response actions and playbooks. |
| Read-only | Manager, auditor | See dashboards, alerts and incidents. Change nothing. |
The full matrix is in Users and roles.
Design principles#
| Principle | What it means in practice |
|---|---|
| Explained, not opaque | Every score shows its four factors and their weights. Every alert in the queue states the rule that admitted it. |
| Nothing is deleted | Alerts held below the threshold are suppressed, not discarded. They stay searchable and return to the queue if they become part of an incident. |
| People decide | Playbooks never start on their own. AI verdicts are advice an analyst can override. Every action is previewed before it runs. |
| Your data stays with you | Alertio is deployed on-premise, for one organisation, inside your network. |
Something missing or wrong on this page? Tell us and we will fix it.