Find the Alerts That Matter
Narrow a noisy queue with the controls at the top of the list:- Filters — status (Open, Acknowledged, Closed, All), time range (from the last hour to the last 30 days), and page size. Sort oldest or newest first.
- Full-text search — match across alert fields to find a rule, host, severity, or indicator.
- Group by — from the Group menu, collapse the list by Host, Severity, Source, Status, Rule Name, Host OS, User, or Process to see patterns instead of a flat stream. The fields offered depend on what your alerts carry.
- Auto-refresh — the queue refreshes itself on a countdown (Next refresh in …), or use Refresh now.
Read the Full Detection
Expand any alert to see the provider’s own detail — the raw fields exactly as the source reported them. For detections from Elastic Security, the expanded view includes the MITRE ATT&CK hierarchy, mapping the alert to its tactics and techniques so you can place it in the wider attack picture.Act on What You Find
Send to Chat
Drop a single alert into the conversation to ask the AI about it in your own
words.
Enrich
Open the Enrichment panel on one alert to attach context, documents and the
assets in play before handing it to the SOC agent.
Enrichment
See how an alert becomes an enriched investigation for Centurion’s SOC variant.
The Alert Management tab is read-only triage. You filter, group, enrich, and route
from here — you don’t change an alert’s status or export the queue. Response
and documentation happen in chat, where you review and approve every action.
Where Alerts Come From
Any detection source you connect surfaces here. Representative providers include:- Elastic Security
- Trend Micro Vision One
- IBM QRadar
- Wazuh
- Rapid7 InsightIDR
- CrowdStrike
- Bitdefender
- SentinelOne
- Zabbix
- Apura
- Axur