Analysis records
Automatic archive of alert investigations, batch triage runs and result explanations, visible to the whole team; jump from a record to querying its subject.
A finished alert investigation, a saved batch triage and an "Explain these results" in Smart query each leave a record here; nothing is saved by hand. Every edition.
Filter and search
Switch by kind at the top: all / investigations / triage / result explanations. The search box matches title and summary. Newest first; "Load more" past the first page.
What a record holds
| Kind | Content |
|---|---|
| Alert investigation | The full report: verdict, false-positive assessment, timeline, affected assets, recommended actions, retrieval trace |
| Alert triage | That run's clusters, severities, recommendations, note |
| Result explanation | The question, the query and the model's reading of the result |
Every record has "Query this subject", which takes the subject (host / IP / account) to Smart query.
Where it lives
The archive is written to .rst_copilot_analysis in ES and backed up with the cluster; everyone sees the same records.
Relation to Posture
The "archived investigations and triages: N" line at the bottom of Posture is this page's count.
Smart query
Query logs in one sentence. The gateway turns it into Elasticsearch DSL, validates it read-only, dry-runs and executes it; when nothing matches it says why and offers a fix.
Batch triage
A batch of alerts clustered by intent and subject; the model scores each cluster, flags likely false positives and suggests actions. Paid.