Triage
Cluster, score and rank a batch of alerts with one actionable recommendation per cluster; dispositions follow the user across devices; per-rule false-positive rates drive noise-reduction suggestions. Licensed.
Input
Three sources, any one:
| Source | How |
|---|---|
| Pull from an index | Index (default alert index notable) + optional SPL filter fragment + time window + cap (default 100) |
| Paste | A batch of alerts as JSON or text |
| Handed over | "Send to triage" on the home page, "Escalate to triage" on the Alerts page, an auto-triage batch (URL carries ?run=) |
The agentic engine runs one read-only SPL per cluster for history and blast radius ([agentic] tools_triage, switchable off alone when large batches are slow). On the 1.9.0 test box 100 alerts → 2 clusters in about 35 s.
Result
KPIs on top (clusters, highest severity, likely false-positive share) plus a donut; then the cluster table:
| Column | Notes |
|---|---|
| Cluster | Rule + subject (rule_id / subject_field / subject_value), the alert ids and first / last seen |
| Severity | Critical / High / Medium / Low / Info, with the reasoning |
| Recommendation | One actionable step |
| Disposition | Open / In progress / Confirmed / False positive / Ignored; stored in the KV store (copilot_state), visible from any device |
| Actions | "Investigate" (full investigation of the cluster's representative alert), "Write back to ES (cluster)", "Escalate" (notify) |
"Save this triage" keeps the batch in history for review and comparison. Alerts the model cannot judge are marked "insufficient evidence" rather than forced into a level.
Auto-triage
The copilot_autotriage alert action appears in Splunk's alert-action list: any saved search can send its results straight to triage, with results in copilot_triage_results. The top of the Alerts page shows recent batches and how many rules carry the action; "Open in triage" opens that batch via the run parameter.
Noise reduction
"Noise reduction" at the top folds the last 30 days ([noise] days) of dispositions per rule: triage dispositions + copilot_state statuses + ES notable status / disposition where ES exists. Rules with FP rate ≥ 60% and at least 10 alerts (fp_rate_threshold / min_alerts) come first, with their top subjects and each subject's false-positive share.
"Suggest" on a rule produces three cards:
| Kind | Content | How the reduction is measured |
|---|---|---|
| Threshold | Change where count > N | Old and new SPL are each run with | stats count on real data; the difference is the "expected reduction" |
| Suppression | alert.suppress fields + period | Measurable only for rules with _time buckets; aggregation-only rules are marked "not measurable" |
| Exclusion | NOT src IN (...) (only subjects with > 80% false positives) | As threshold; the exclusion is placed after the field exists (| where after a rex) |
"Apply" (admin) edits the saved search after backing it up to the KV store; "Suppressed · Undo" on the row reverts. A Splunk Free licence rejects alert.suppress*, so suppression cannot be applied there. The rule name must equal the saved-search name to apply; interactive-triage clusters whose rule_id fell back to a sourcetype have no saved search and get suggestions only.
Investigations
The archive of investigation, triage, explanation and report conclusions: browse by type and time, search, follow up on the home page.
Detection rules
One sentence of detection intent → a deployable scheduled saved search; deploy, enable, edit in place; an ATT&CK coverage heatmap for gaps. Licensed; the engine ships sealed.