From intel to detection: Alerts, Detections & Hunts

Act on the corpus — triage the alerts raised for you, and work detection coverage and hunt hypotheses against ATT&CK.

Intelligence earns its keep when it changes what you do. These workspace surfaces close that loop.

Alerts Account

Alerts surfaces auto-generated signals tied to your requirements and exposure — a KEV that maps to your stack, a fresh impersonation domain, a report tagged to your sector. Each carries a stated confidence and says why it matters and what to do next, so it’s a queue of leads to triage, not a firehose to drown in — and not adjudicated findings.

Detections & Hunts Account

Detections & Hunts is where coverage and hypotheses live: which ATT&CK techniques your detections cover, where the gaps are, and the hunt hypotheses to run against them. It’s the bridge from “we understand this actor” to “we would see them if they showed up.”

Two more surfaces sharpen the work: Competing Hypotheses (ACH) weighs rival explanations against the evidence so you don’t anchor on the first one, and Detection Inventory is the catalog of the individual detections behind the coverage view.