Skip to main content

Alert triage

Alert triage groups related signals and prioritizes alerts for investigation within each Space's AI budget. Consolidation prevents duplicate investigations from consuming capacity separately. Perpetual scores consolidated alerts that enter automatic triage and compares their priorities with a dynamic promotion threshold, directing the available budget toward higher-priority alerts. Promotion opens a case, while the available budget determines whether Perpetual starts an automated investigation.

A weekly budget limits AI triage and investigation work in each Space​

Each Space's weekly AI budget defaults to zero. You must set a positive budget before Perpetual can automatically triage alerts or investigate cases. The budget gives Perpetual a spending limit even when a noisy detection produces an unexpected volume of alerts.

Users with the Manage Simba Settings capability can set a weekly AI budget for each Space. This budget covers background agent work involved in triage and case investigation. Perpetual stops starting automatic agent work when the Space has no budget available.

Set the weekly budget to zero to disable automatic AI triage and investigation entirely. You can still triage alerts and investigate cases manually, or manually ask Simba to investigate, even if automatic triage and investigation is disabled.

Perpetual consolidates alertable signals it deems related into a single alert before scoring and promotion, preventing duplicate investigations from consuming AI resources. Detections can define relatedness through an accumulationKey which identifies the signal fields Perpetual compares. Signals from the same detection in the same Space join one alert when all selected values match.

Set the key in the detection's "Playbook" tab using "Accumulation Key". Select fields from the detection's output, or add a nested map field path such as labels.account_id. For example, a detection that emits labels.account_id and labels.source_ip can group repeated failed logins by both fields. Attempts for the same account from the same IP accumulate together, while a different account or IP produces a separate group. Choose fields that identify related activity. A timestamp or unique event ID would usually separate every signal. Save the detection change and commit its changeset to apply it. Leaving the key empty disables this field-based grouping.

The alert triage routing agent handles relationships those fields do not capture by comparing each new alert with open alerts in the same Space. It iteratively folds new alerts into existing alerts to minimize the number of distinct alerts that proceed to scoring and investigation. Its search is always confined to a Space.

When grouping or routing adds signals to a queued alert, triage scores the expanded alert again. It can also add new signals to existing cases, which can trigger further AI investigation when budget is available and automatic investigation is enabled.

Priority and budget determine automatic promotion​

The alert triage scoring agent assigns the alert a priority and summary from its accumulated signals and the detection's response guidance. A detection can also hard-code a priority floor for its alerts. Triage uses the higher of the two.

Automatic promotion compares an alert's priority with the Space's budget-derived promotion threshold. Perpetual adjusts this threshold based on the Space's recent alert priorities, average case cost, and budget left in the week. Available capacity admits lower-priority alerts, while a tighter budget reserves investigation for higher-priority alerts. A Space's configurable minimum promotion priority sets a floor the dynamic threshold cannot fall below. With limited history, Perpetual uses a separate starting threshold, raised to that floor if necessary. Triage starts an automated case investigation only when the alert qualifies for promotion, budget is available, and automatic investigation is enabled.

An alert below the threshold stays queued until added signals trigger another score, a lower threshold makes it eligible for promotion, you promote it, or it expires. Perpetual checks queued alerts against a changed threshold using their existing priorities. A threshold change can therefore promote an alert without asking the scoring agent to score it again.

Manual promotion overrides the automatic decision​

A Space's always-promote priority controls which alerts still open cases after its AI budget is spent. This allows you to set a threshold above which alerts are serious enough to warrant a case, even when the Space has no budget available to investigate them. This should generally be set high enough that only the most severe alerts always promote. Perpetual opens these cases without starting an automated investigation. You can investigate them yourself or explicitly ask Simba to investigate, which can incur AI spend beyond the automatic budget.

If you decide to intentionally exceed budget, you can manually promote a queued alert or trigger automated investigation on any uninvestigated case. These actions override the budget limits that govern automatic triage and investigation.

This is an intentional escape hatch for true incidents, where AI limits should not block critical work. Perpetual does not cap AI activity you trigger manually. You are responsible for deciding when the override is warranted and using it sparingly.