Alerts

The SOAR Alerts page is the central workspace for reviewing, triaging, investigating, and managing security alerts in Logstail. It gives SOC users a single view of alert volume, alert severity, affected agents, MITRE context, alert status, ownership, and response actions.

Where to find it

What this page is used for

Access depends on the user’s assigned role and subscription context. Users without the required SOAR access may see a role or plan restriction page instead of the alert workspace.

Who uses this page

The SOAR Alerts page is designed for security operations workflows, especially for:

Page Overview

Timeframe Selector

The timeframe selector is located in the top-right control area of the SOAR Alerts view.

It appears next to the notification threshold selector and the Refresh button. The selector displays the active date and time range, for example:

Jun 3, 10:47 → Jun 4, 10:47

Clicking the timeframe selector opens the date and time picker.

From this picker, users can:

The selected timeframe controls which alerts are included in the page view. It affects both the summary charts and the alert table.

Use timeframe selection to:

When a custom start and end date are selected, the charts and table update to show alerts from that period.

Charts and Alert Metrics

Search & Filter Alerts

Alert Search Filters help users reduce alert noise and focus on the alerts that matter.

Users can filter alerts by available alert fields such as:

Common filters for everyday workflows include:

After applying filters, users can clear them to return to the full alert view for the selected timeframe.

Visible Filter Options

By clicking on the Filter button above the alert table you are provided the following filter options:

Alerts Table

The alerts table is the main triage area. It displays alerts that match the selected timeframe, search query, and filters.

The table includes these core columns:

Sort Alert Data

Use column sorting to reorder table results and move high-value records to the top. You can do this by clicking on one of the table columns, which will create a sort by arrow.

Sorting is useful for:

Open Alert Details

Use Show Details to open the alert detail view.

Alert details should be reviewed before high-impact actions such as closing an alert, marking it as verified, declaring it a false positive, or creating a case.

Investigate an Alert

Use the Investigate action when an alert needs deeper analysis.

Investigation helps the user pivot from the alert into supporting telemetry. This is where an analyst can validate whether the alert is real, look for related events, and determine the scope of activity around the affected agent or timeframe.

Use investigation when:

Create a Case from an Alert

Use Create Case when an alert requires incident response tracking.

Creating a case is appropriate when:

A case allows the team to coordinate investigation work and link related alerts, assets, playbooks, IOCs, and notes.

Add an Alert to an Existing Case

Use Add to existing case when the alert belongs to an incident that is already being tracked.

This keeps related evidence grouped together and avoids creating duplicate cases for the same incident.

Use this when:

Set Alert Status

Alert status communicates where the alert is in the triage lifecycle.

A recommended workflow:

Set Alert Flag

Alert flags communicate analyst validation.

Use Verified when the alert reflects real suspicious or malicious activity.

Use False Positive when the alert is benign, expected, test-generated, misconfigured, or otherwise not security-relevant.

Assign Alerts

Use the Assignee field to assign ownership to a user in the stack.

Assignments improve accountability and reduce duplicated work. By default, alerts may appear unassigned. Selecting the assignee field opens a user selection popup where an alert can be assigned to an available user account.

Use assignments to:

Assignments can also be applied through bulk actions.

Use Bulk Actions

Bulk actions let users operate on multiple selected alerts at once.

Use bulk actions for fast triage when several alerts share the same conclusion or owner.

Common bulk action examples:

Delete Alerts

Manage False Positives

False-positive management is used to reduce repeated handling of known benign alerts.

When a user selects the false-positive action, Logstail displays a checklist of field-value pairs extracted from the log that caused the alert. These field-value pairs describe the alert context that contributed to the detection.

There are two main false-positive options:

Use Flag This Alert when the alert is a one-off benign event.

Use Flag All Related Alerts when the same benign pattern is repeatedly generating noise and should be suppressed or handled automatically.

False-Positive Rulesets

False-positive rulesets help suppress repeated benign alert patterns.

A ruleset can automatically handle alerts when:

When matched, related alerts can be automatically closed and flagged as false positive without an assignee. This improves signal-to-noise ratio and keeps analysts focused on meaningful alerts.

Use precise field-value pairs. Broad rules can suppress alerts that should still be investigated.

Review Frequent and Infrequent Alerts

The frequency controls help users identify alert patterns.

Frequent alerts can indicate:

Infrequent alerts can also be valuable. Rare detections may represent manual attacker behavior, unusual administrator activity, or abnormal endpoint events.

Use frequency review during shift handover, detection tuning, and incident discovery.

Generate an Alert Report

Use Generate Report to create a report from the current page state.

Before generating a report, set the correct timeframe, search terms, and filters. The report reflects the current page context, so it should be scoped intentionally.

Use generated reports for:

Export Alerts

Use Export to download alert data in a structured format such as CSV or XLSX.

Exports are useful for:

Exported alert attributes may include fields such as agent name, agent group, alert name, severity, MITRE tactic, timestamp, status, flag, and assignee.

Use Live Refresh

Live refresh keeps the alert table updated with incoming alerts.

Users can configure refresh frequency in minutes or seconds and start or stop automatic refresh. While live refresh is active, the interface indicates that updates are running.

Use live refresh for:

Stop live refresh when performing careful manual triage to avoid losing context as the table updates.

Pagination

Pagination controls how many alerts appear per page and how users move through the alert queue.

Pagination controls typically include:

Use pagination when reviewing large alert volumes or when filtering still returns many results.

Recommended Triage Workflow

Use this workflow for clean and consistent alert handling:

Troubleshooting

Best Practices

Related Pages