VERISCO Alertio Detect and prioritise
Alert Pipeline
How the raw detection feed was reduced to the alerts your analysts see, and why each individual alert received the score it did.
Open Alert Pipeline in the Detect group. This is the screen to open when someone asks where a number came from.
The funnel#
Five stages run across the top, for the time range you choose.
| Stage | Means |
|---|---|
| Raw Events | Every alert received in the period. |
| Deduplicated | What remains once identical alerts in a five-minute window are combined. The percentage is how much was collapsed. |
| Risk Scored | Unique alerts that were given a score. |
| Queued | Alerts that reached the Triage Queue. |
| Suppressed | Alerts held below the gate. Kept and fully readable; nothing is deleted. |
In our validation lab, 26,506 raw events deduplicated to 1,443 unique alerts, of which 222 reached an analyst.
The panels#
| Panel | Shows |
|---|---|
| Score distribution | Every scored alert by score, split into queued and suppressed. Select a bar to filter the list to that score band. |
| Queue reasons | Why each queued alert was admitted: score, severity floor, correlation, AI detection or brute force. See why an alert is in the queue. |
| Top score drivers | The weights currently in force. |
The inspector#
Select any alert in the list to open the inspector. It lists the four factors with their raw value, their weight and the points each contributed; the four contributions add up to the displayed score. From the inspector, links lead straight to the risk weights and to asset criticality.
Controls#
| Control | What it does |
|---|---|
| Time range | Sets the period the funnel covers. |
| All / Queued / Suppressed | Restricts the list to alerts in that state. |
| Search | Matches within the current list. |
| Sort | Risk score or time, ascending or descending. |
| Refresh | Recalculates the pipeline. |
Something missing or wrong on this page? Tell us and we will fix it.