FAQ

Does Alertio replace our detection rules?#

No. Alertio sits on top of detection. Your rules decide what is suspicious; Alertio decides what deserves a person's time, connects related alerts into attacks, and carries the response to the endpoint.

Is anything deleted when an alert is suppressed?#

No. Suppressed alerts are kept, searchable and auditable on the Alert Pipeline. One that later becomes part of an incident returns to the queue automatically.

Can a critical alert be lost because its score is low?#

No. Any alert its detection rule rates critical reaches the Triage Queue whatever its score, as does any alert that belongs to an open incident.

Why not just raise the severity of the rules we care about?#

Severity cannot know which machine was hit or what happened around it. The same rule on a test laptop and on your domain controller deserves a different priority. That is what asset criticality and the risk score add.

Does the AI make decisions?#

No. An AI verdict is recorded as advice. It never changes an alert's status, closes it, or starts a response. Analysts agree or override, and the agreement rate is reported openly on the AI Analysis screen.

Does our data leave our network?#

Alertio is deployed on-premise, inside your network, for one organisation. Two features can reach outside it, and both only when used: a threat intelligence lookup sends the observable you look up (a hash, an address, a domain or a URL) to VirusTotal, and an AI analysis sends the alert to the model, which you can host on your own infrastructure so that nothing leaves.

Do playbooks run automatically?#

No, by design. A person starts every playbook, and each step is acknowledged before it runs. A dry run shows exactly what would happen first. See Playbooks.

Can a response action be undone?#

Blocks and isolations can: release them, or undo the playbook run that created them. Blocks also lift on their own after 10 minutes. Killing a process and quarantining a file cannot be undone, which is why they are reserved for administrators. See Response actions.

Which operating systems can be monitored?#

Windows, Linux and macOS, on both Intel and ARM where applicable. See Deploy agents.

Does Alertio send email or Slack alerts?#

No. Notifications appear in the console's notification centre. See Notifications.

How many people can use it?#

There is no limit on accounts. Each person gets one of three roles. See Users and roles.