Alert TriageAlert Triage Documentation

Incident Responder Release Notes

Advanced Analytics Release Notes

To help you quickly determine which alerts to look at first, view the alert's priority determined by machine learning and analytics: high, low, or observational. To narrow down the alerts you see, filter alerts by priority.

It may take Alert Triage up to three weeks to train, during which your alerts aren't assigned a priority.

To get an overview of all your alerts and team's activity, view Alert Triage metrics under Alert Insights, including the total number of alerts you received and how many alerts have a given priority.

Names for existing alerts didn't appear under the Name filter criteria because an incorrect parameter returned a limited number of alert names. Now, the correct parameter is used and returns all existing alert names.

Case Manager incidents created from escalated alerts couldn't trigger Incident Responder playbooks because a parameter was missing. Now, the parameter has been added.

In some cases, when you clicked on a notification or filter criteria, you received a Request failed with status code 503 error because of a memory issue. Now, performance has improved significantly.

Filters have replaced channels. To quickly triage and find the highest priority alerts, filter all alerts by criteria you define, like source, severity, type, and name, then save the filter. You can also make filters private to you, or public to certain people or everyone in Alert Triage.

Navigate to the newest alert in a tab by clicking Jump to newest alert.

Dismiss multiple alerts at once by selecting the checkbox next to each alert, then clicking Dismiss.

Choose to show or hide dismissed alerts in a tab by toggling Hide dismissed alerts.

Alert Triage adjusts to the width of your window so you can use Alert Triage on any device or screen size.

You see standardized values for alert types and severities; for example, if the severity of a third-party alert is medium, Medium, or Med, it is displayed as Medium in Alert Triage.

To prevent Alert Triage from running out of memory, you can only see alerts that are less than 90 days old.

Performance and stability improvements.

If no anomalies occurred before the security alert, you didn't see any anomalies under the Nearby Anomalies, Top <#> tab. Now, you can see all anomalies that occurred before, during, and after the alert under the Show all tab.

Minor bugs and UI issues.