Verisco
Documentation

VERISCO Alertio Get started

How Alertio works

The components behind the console, how a detection becomes work for an analyst, and how your data and credentials are protected.

The components#

Component Where it runs What it does
Endpoint agents On each monitored machine Collect security events, report inventory, vulnerabilities and file changes, and carry out response actions.
Sensors At the network edge and on key services Network intrusion detection, mail and directory events, forwarded like any other endpoint.
Detection engine In your SOC network Stores events and applies detection rules. Every match becomes an alert.
Alertio server In your SOC network Scores, deduplicates and correlates alerts, runs the queue rules, orchestrates response, and serves the console.
Console In the browser The screens described in this documentation.

New data sources can be connected without changing how alerts are scored, correlated or answered.

From detection to decision#

queued below the gate part of an incident Raw events every detection Deduplicate 5-minute window Risk score four factors, 0-100 Queue rules gate, floor, AI Suppressed kept, searchable Triage Queue an analyst's list Correlation builds incidents
Every alert is deduplicated and scored. The queue rules admit it to the Triage Queue or hold it as suppressed; the correlation engine admits anything that belongs to an incident.
  1. A detection rule matches an event and produces an alert.
  2. Identical alerts within five minutes are deduplicated into one, with a count.
  3. Each alert receives a risk score from four factors. See Risk scoring.
  4. The queue rules decide whether it reaches an analyst. See Triage Queue.
  5. In parallel, the correlation engine groups alerts into incidents and places them on the kill chain. See Incidents.

Security of the platform#

Area How it is handled
Deployment On-premise, single-tenant: one organisation per installation, inside your network.
Access Three roles, enforced in the console and again on every request to the server.
Integration keys Stored encrypted and never shown back in the browser.
Accountability Account and configuration changes are written to an audit record, attributed to the person who made them. Every response action is recorded with who ran it and what came of it.
AI The model can run on your own infrastructure. An analysis runs only when an analyst asks for one, or under the rate-limited AI triage process when you enable it.

Something missing or wrong on this page? Tell us and we will fix it.

↑↓ to move Enter to open Esc to close