// Operations
Alert triage
Detections raised by correlation rules, waiting on an analyst decision: dismiss as benign, or escalate into a case.
2awaiting triage3in progress1closed as benign
8 alert(s) in the queue
Disposition all
Triage queue
8 alerts
| Alert | Detection | Severity | Risk | Principal | Raised | Disposition |
|---|---|---|---|---|---|---|
| ALT-971696 | Impossible travel for jsmith Impossible travel · T1078.004 | Critical | 92Severe | jsmith | InvestigatingOpen case | |
| ALT-664EB4 | Encoded PowerShell executed on WIN-DC01 Encoded PowerShell execution · T1059.001 | High | 81Elevated | jsmith | InvestigatingOpen case | |
| ALT-D6DD3D | Word spawned a shell that downloaded a remote payload Office application spawning a script interpreter · T1204.002 | High | 78Elevated | ekowalski | ||
| ALT-A61185 | Password spray from 185.100.200.50 against 24 accounts Password spray against directory services · T1110.003 | High | 74Elevated | jmercier | InvestigatingOpen case | |
| ALT-70BAD5 | 1.2 GB transferred to an unrecognised destination Bulk data egress · T1048 | Medium | 55Moderate | hlindqvist | ResolvedOpen case | |
| ALT-655369 | Bulk document read on the Finance share Mass file access · T1005 | Medium | 52Moderate | hlindqvist | ResolvedOpen case | |
| ALT-701421 | IAM access key created outside the change window Cloud access key created outside change hours · T1098.001 | Medium | 46Moderate | bpatel | ||
| ALT-9A3E1E | Legacy TLS negotiated on the perimeter Bulk data egress · T1048 | Low | 12Low | 203.0.113.44 |