Triage
Cluster, score and rank a batch of alerts with one actionable recommendation per cluster. Dispositions follow the user across devices; per-rule false-positive rates drive noise-reduction suggestions. Licensed.
Triage clusters, scores and ranks a batch of alerts and is a paid capability. This page covers input sources, the result table, auto-triage and noise reduction.
Input
| Source | Description |
|---|---|
| Pull from an index | Index (default alert index notable), optional SPL filter fragment, time window, cap (default 100) |
| Paste | A batch of alerts as JSON or text |
| Handed over | Send to triage on the home page, Escalate to triage on the Alerts page, an auto-triage batch (URL carries ?run=) |
The agentic engine runs one read-only SPL per cluster for history and blast radius ([agentic] tools_triage, switchable off alone when large batches are slow). On the 1.9.0 test box, 100 alerts become 2 clusters in about 35 s.
Result
KPIs on top (clusters, highest severity, likely false-positive share) plus a distribution chart; then the cluster table:
| Column | Notes |
|---|---|
| Cluster | Rule and subject (rule_id, subject_field, subject_value), the alert ids and first and last seen |
| Severity | Critical, High, Medium, Low, Info, with the reasoning |
| Recommendation | One actionable step |
| Disposition | Open, In progress, Confirmed, False positive, Ignored. Stored in the KV store (copilot_state), visible from any device |
| Actions | Investigate (full investigation of the cluster's representative alert), Write back to ES (cluster), Escalate (notify) |
Save this triage keeps the batch in history for review and comparison. Alerts the model cannot judge are marked insufficient evidence rather than forced into a level.
Auto-triage
The copilot_autotriage alert action appears in Splunk's alert-action list. Any saved search can send its results straight to triage, with results in copilot_triage_results. The top of the Alerts page shows recent batches and how many rules carry the action; Open in triage opens that batch via the run parameter.
Noise reduction
Noise reduction at the top folds the last 30 days ([noise] days) of dispositions per rule: triage dispositions, copilot_state statuses, and ES notable status and disposition where ES exists. Rules with an FP rate of 60% or more and at least 10 alerts (fp_rate_threshold, min_alerts) come first, with their top subjects and each subject's false-positive share.
Suggest on a rule produces three cards:
| Kind | Content | How the reduction is measured |
|---|---|---|
| Threshold | Change where count > N | Old and new SPL are each run with | stats count on real data; the difference is the expected reduction |
| Suppression | alert.suppress fields and period | Measurable only for rules with _time buckets; aggregation-only rules are marked not measurable |
| Exclusion | NOT src IN (...), only for subjects with more than 80% false positives | As threshold. The exclusion is placed after the field exists (| where after a rex) |
Apply (admin) edits the saved search after backing it up to the KV store; Suppressed, Undo on the row reverts. A Splunk Free licence rejects alert.suppress*, so suppression cannot be applied there. The rule name must equal the saved-search name to apply; interactive-triage clusters whose rule_id fell back to a sourcetype have no saved search and receive suggestions only.
Investigations
The archive of investigation, triage, explanation and report conclusions. Browse by type and time, search, and follow up on the home page.
Detection rules
One sentence of detection intent becomes a deployable scheduled saved search. Deploy, enable and edit in place; an ATT&CK coverage heatmap locates gaps. Licensed; the engine ships sealed.