Triage
A batch of offenses clustered by rule and source; the model rates each cluster's severity, calls false positives, recommends action, and queues them by priority. Paid capability.
Triage answers "which of the 300 offenses in the queue first". Offenses with the same rule and offense_source are clustered first, the model scores clusters, and 300 offenses usually collapse to a dozen decisions.
Paid capability, Standard tier (including the 14-day trial) and up. Unactivated, the page points to activation.
Submitting a batch
Two inputs:
- Pull OPEN offenses (default): no input needed; takes OPEN offenses from the gateway's copies within a window (minutes, up to 7 days, by offense
start_time). The copies come from the Offenses sync; with sync off or a short lookback there is nothing to pull. - Handed over: "Send to triage" in Ask AI or in an offense detail brings offenses straight here; the top shows "N alerts received" and the window only serves "Investigate" for context.
Two caps: max offenses (100; beyond that only the newest batch, marked "first N of total" in the result) and clusters sent for scoring (30; more clusters are sorted by size and the rest go unscored).
Clustering is local; scoring calls the model (RST_TRIAGE_LLM_CHUNK clusters per call, RST_TRIAGE_LLM_CONCURRENCY in parallel). Dozens of clusters on a reasoning model take 1–3 minutes.
Reading the result
Four cards: total offenses (in how many clusters), scored, high and above, severity donut.
The triage queue is sorted by priority, one cluster per row:
| Column | Meaning |
|---|---|
| Severity | Model-rated: critical / high / medium / low / info; "suspected false positive" is flagged separately |
| Intent / subject | What the cluster is doing and which source IP / destination host / account |
| Count | Offenses in the cluster |
| Span | First to last |
| Disposition | open / handled / false positive / escalated; syncs at once to the Offenses feed, team-wide; never written to QRadar |
Expand a row for the recommended action and the cluster's offense IDs. Select several rows to change disposition at once.
From a cluster
- Investigate: pull context around the cluster's subject within the window and run an offense investigation.
- Compare: add clusters to the side-by-side panel at the bottom to see whether they are facets of one incident.
- Escalate: setting disposition to "escalated" offers to push to the on-call channel; targets are set up in Outbound channels.
To close offenses in QRadar, go back to the Offenses drawer one by one; the triage page never writes to the Console in bulk.
Save and export
- Save this run: add a note and store it server-side; the whole team sees it under "Past runs" and in Investigations.
- Export CSV: take the queue with you.
Scoring incomplete
On a model timeout or error the page shows "AI scoring incomplete" and still lists clusters sorted by size (no severity or recommendation); retry later. One scoring call on a reasoning model can exceed the provider's timeout_s (180 s); if it keeps happening, raise it or set reasoning effort to low in AI settings.
Offenses
Polls QRadar offenses and summarises each; group, filter and disposition them in a live feed; notes and closes are written back to QRadar; one offense can be investigated.
Rule copilot
Describe the behaviour to catch in one sentence and get a QRadar Rule Wizard design: test conditions, rule response, backtest AQL, MITRE ATT&CK, checked against live rules for duplicates. Analysts configure the rule in the wizard; the product never writes to QRadar. Paid capability.