Settings

Open Settings in the Administration group. Sections are listed on the left. Everyone can change Appearance; every other section requires the Administrator role.

Detection and scoring#

Four sections decide how alerts are ranked. Each maps to part of the risk score.

Risk weights#

The four sliders that weight severity, asset criticality, deduplication and time context. Each shows how far it has moved from the saved value. Lock total keeps the weights summing to 1.00 while you adjust: raising one lowers the others in proportion.

Open the Alert Pipeline afterwards to see the distribution shift.

Asset criticality#

Records how important each machine is: Low, Medium, High or Critical. An entry can name a machine by its agent, its hostname or its address; a machine not listed counts as Medium.

Classify your crown jewels first: domain controllers, mail, database and file servers. It is the change that most improves the queue.

Schedules#

Time windows, by day and by hour, that change the weight an alert's timing carries. An alert inside a schedule takes the schedule's level as its time context; outside every schedule it counts in full. Use them to weight activity differently inside and outside working hours, or during maintenance.

Trust rules#

Activity you know to be legitimate, so it stops consuming attention. Each rule has a trust level, Low, Medium, High or Fully trusted, and the higher the trust, the more the score of matching alerts is lowered. Fully trusted sets it to zero.

Trust never hides a compromise: a trusted host's alerts still reach the queue when they are critical or part of an incident.

Appearance#

Light or dark theme. The choice is remembered on this browser.

Integrations#

The VirusTotal connection used by threat intelligence and by the Enrichment tab of every alert.