Triage
Cluster a batch of alerts by intent and subject. The model scores each cluster, flags likely false positives, recommends actions, and ranks the queue. Paid.
Batch triage decides the order in which to work an alert queue. Alerts with the same attack intent and subject are clustered locally, then the model scores each cluster, so 300 alerts typically reduce to about a dozen decisions.
Paid feature, available in Professional (including the 14-day trial) and above. Without activation, the page points to License.
Submit alerts
By default, alerts are pulled from Elasticsearch. When you select Send to triage on a result card in Ask AI or in the alert details on Alerts, the alerts arrive on this page with the received count at the top, and Time window (minutes) is used only to gather context for investigations.
Steps
- Under Submit alerts, enter the alert index in Index, for example Elastic Security's
.alerts-security.alerts-default. - (Optional) Enter a JSON filter in Query (optional), for example to keep only alerts whose
kibana.alert.statusisactive. When empty, every alert in the window is taken. - Set Time window (minutes). The default is 60 and the maximum is 7 days.
- Select Start triage.
Clustering is local and scoring calls the model. A few dozen clusters take 30 to 130 seconds.
| Cap | Default | Beyond the cap |
|---|---|---|
| Maximum alerts | 100 | Only the newest batch is triaged, and the result says so |
| Maximum clusters sent to the model | 30 | Clusters are ordered by alert count and the rest are left unscored. The result suggests raising the cap and submitting again |
Triage result
The top row shows Alerts with the cluster count, Scored, High and above, and the Cluster severity mix. The Triage queue lists one cluster per row, highest priority first.
| Column | Meaning |
|---|---|
| Severity | The model's rating: critical, high, medium, low, or info. Likely false positive is flagged separately |
| Attack intent / subject | What the cluster does, and which host, IP, or account is involved |
| Alerts | Alert count in the cluster |
| Time span | First to last alert |
| Disposition | Open, Handled, False positive, or Escalated. Syncs to Alerts and is visible to the whole team |
Select a row to show the Recommendation and the cluster's alert IDs. Select several rows to change their disposition at once. When scoring draws on Runbooks, the result states how many documents it used.
Act on a cluster
| Action | Description |
|---|---|
| Investigate | Gathers context around the cluster's subject within the window and runs an alert investigation |
| Compare | Adds the cluster to the Side-by-side comparison below, to judge whether several clusters are one incident |
| Escalate | Setting the disposition to Escalated asks whether to push to the on-call channel, which must exist in Outbound channels |
Save a triage run
Every completed run is archived in Investigations. To share a run with the team, select Save this run and add an optional note; the run is stored on the server and listed under Past runs. Export CSV exports the current queue.
Incomplete scoring
On a model timeout or error, the page reports that scoring did not complete and lists the clusters by alert count, without severity or recommendation. Submit again later to retry. If it keeps happening, check the provider's health in AI settings.
Investigations
Automatic archive of alert investigations, triage runs, and result readouts, with a jump from a record to a query on its subject.
Detection rules
Describe the behavior to detect in plain language and get a Kibana detection rule (KQL, EQL, or threshold) mapped to MITRE ATT&CK. Export it as .ndjson and import it into Kibana. Paid.