Triage Queue

The analyst's working list. Only alerts that need a person are in it, and each one states which rule put it there.

Open Triage Queue in the Detect group.

The Triage Queue: the triage funnel from raw detections to queued alerts, status tabs, AI verdict and reason filters, and the alert table ranked by priority. — The Triage Queue, ranked by priority, with the funnel that produced it across the top.

Why an alert is in the queue#

An alert enters the queue for one of five reasons, and the row says which. The last four apply whatever the alert's own score.

Reason	Admits an alert when
Gate score	Its risk score reaches the gate: 50 by default.
Severity floor	Its detection rule rates it critical. A critical detection always reaches a person, even on a low-value machine.
Incident	It belongs to an open incident and is part of that attack's activity.
AI-flagged	The background AI triage judged it malicious. See AI-assisted triage.
Brute force	Repeated authentication failures or scanning from one source, where the repetition is itself the attack.

The gate is set when Alertio is deployed.

Read the reason

An alert admitted as part of an incident may have a low score of its own. It is there because it is one step of a larger attack, which scoring alone would have discarded.

Working the queue#

Work from the Active tab, which combines New, Triaging and Escalated.

Status	Means
New	Nobody has taken it yet.
Triaging	Someone is working on it. Move an alert here when you start, so colleagues can see it is taken.
Escalated	It needs action or a second opinion.
Dismissed	Reviewed and closed. Still visible on its own tab.

Status persists on the server: everyone on the team sees the same state, and every change is recorded with its author.

The list is ranked by priority by default. Recency and AI verdict are separate, so you can sort and filter by either without losing the ranking.

Filters#

Filter	Restricts to
AI verdict	Malicious, Review, Inconclusive or Benign.
Why queued	Gate score, severity floor, incident or AI-flagged.
Search	Alert, endpoint, IP address, rule and MITRE technique.
Advanced	Endpoint, MITRE technique, source IP, rule ID and a priority range.

The detail panel#

Select a row to open its panel, with four tabs: Overview, Timeline, AI and Raw. Where an AI verdict exists, record whether you Agree or Disagree; your answer feeds the agreement figures on the AI Analysis screen. Where the alert belongs to an incident, its number links straight to it.

Bulk actions#

Select several rows with their checkboxes to Assign, Escalate or Dismiss them together.

Reviewing what was held back#

Review suppressed shows the alerts below the gate, so nothing is hidden from audit. To understand why a particular alert was held back, open it on the Alert Pipeline.

Changing an alert's status requires the Analyst or Administrator role.

Something missing or wrong on this page? Tell us and we will fix it.