Skip to main content
Enrichment is the bridge between triage and response. Starting from one alert or several, you assemble everything the AI team needs to work — the context it belongs to, supporting documents, the devices and integrations involved, and threat intelligence on its indicators — and then hand the whole package to the chat in a single step.

​
Where It Starts

Open Case Management from the Directory and go to the Alert Management tab. Choose a scope first — all integrations, an integration type, or one specific integration. Nothing is fetched until you choose, which avoids querying every integration at once.

From one alert

Use Enrich on the alert’s own row.

From many alerts

Tick the checkboxes on a cluster. The selection bar at the bottom shows how many are selected and offers a single Enrich for all of them.
Each row also carries Send to Chat, which drops the alert straight into the conversation without the enrichment step. Use Enrich when you want to attach context first.

​
What You Assemble

Enrich opens an Enrichment panel. It isn’t a sequence of steps — every section is on screen at once, already filled in where the platform can infer something, and yours to adjust before you send.
When the alerts carry no indicators, the panel says so plainly — “No IOCs detected in this alert data” — rather than leaving you guessing whether the lookup ran.

​
Sending It to the Chat

The footer counts the assets you’ve attached and offers Send to Chat. From there the enriched alert runs like any other conversation: Centurion coordinates the specialists — Orion to work the indicators, Perseus to inspect or act on an affected host — and you watch the reasoning and tool calls stream in live.

Centurion, in SOC mode

How the orchestrator runs a detection-and-response investigation end to end.
Enrichment prepares and hands over; it doesn’t act on your environment by itself. Any response — isolating a host, blocking an indicator — is proposed in chat for you to approve. See AI proposes, you approve.

​
From Investigation to Record

Once the picture is clear, ask Scribe to write the investigation up as a report you can share, or keep the conversation as your working record.