VERISCO Alertio Investigate
AI-assisted triage
How Alertio uses a security-specialised language model to give a second opinion on an alert, how analysts confirm or override it, and why it never decides on its own.
Alertio can send an alert to a security-specialised language model, Foundation-Sec-8B, which returns a verdict, a confidence and the reasoning behind it. The AI Analysis screen, in the Investigate group, holds the record of every analysis and reports how often the model and your analysts agreed.
Running an analysis#
An analysis is started from an alert, not from the AI Analysis screen:
- in Alerts, with Ask AI on the row, or on the Analysis tab of the alert panel;
- in the Triage Queue, with Run AI on the row.
The result contains:
| Part | Contains |
|---|---|
| Verdict | True positive, false positive, or needs review. Needs review means the model declined to commit, and the alert stays with a person. |
| Confidence | How sure the model says it is. |
| Explanation | Its reasoning in plain language. |
| Signals | The evidence in the alert that supports the verdict. |
| What would change it | What evidence would move the verdict the other way. |
| Raw response | The model's unedited output. |
Running an analysis requires the Analyst or Administrator role.
Feedback#
Open an analysis and use Feedback to record your judgement: Verdict is right, or Override verdict. In the Triage Queue the same choice is Agree or Disagree.
Feedback is what makes the model's reliability measurable. The figures at the top of the screen count the analyses run, the true positives, the average confidence and the overrides, and Agreement with analysts shows how often a reviewed verdict was upheld.
Background AI triage#
When your deployment enables it, a background process submits fresh high-threat alerts to the model automatically, within a fixed rate limit. An alert the model judges malicious is AI-flagged and admitted to the Triage Queue, where a person decides what to do with it.
For incidents#
On an incident, Generate attack story asks the model for a narrative: how the attack started, how it moved through the kill chain, why these alerts belong together, and a recommended response.
The model is advisory#
An analyst always decides
An AI verdict never changes an alert's status, never closes it, and never starts a response. It is recorded as advice. The override rate is reported openly so the model can be judged on evidence.
Privacy and availability#
The model can run on your own infrastructure, so alert data does not have to leave your network. The Model and service panel shows whether it is reachable. If it is not, the screen says so: saved analyses stay readable, new runs pause until it reconnects, and Check again retests the connection. Everything else in Alertio works without it.
Something missing or wrong on this page? Tell us and we will fix it.