Alerts & incidents
The console is where Mobius's work becomes reviewable. Three views matter day to day.
Alerts
Every ingested alert with its L1 decision attached:
- Verdict and risk score, with the analyst rationale one click away — the full decision trail is auditable per alert.
- MITRE ATT&CK technique and tactic chips.
- Filters by environment, verdict, severity, rule, agent, and time.
Use it to answer "what did Mobius decide, and why" — and to spot-check verdicts while you tune your trust in automation.
The alert detail
Click any row to open the alert detail. The panel at the bottom groups
everything Wazuh and the AI captured into tabs: Triage history, IoCs,
MITRE, Compliance, the Wazuh categories (Rule, Agent, Data,
Decoder / Manager), and raw JSON. Most chips are clickable pivots:
click a MITRE tactic, a rule group, a compliance framework, or a source /
agent IP to jump to the alerts list pre-filtered by that value. MITRE
technique ids link out to attack.mitre.org, and every IoC has a one-click
copy button.
When the alert's environment has a Wazuh Dashboard URL configured, a Go to Wazuh button in the header jumps straight to the exact document — or its surrounding events — in your own Wazuh Dashboard Discover view, opened with your own dashboard login.
Archive noisy alerts
Tidy the queue by archiving alerts you have handled or consider noise: per row, in bulk, or every alert matching the current filters. Archived alerts drop out of the default view; flip the Archived filter to archived or all to bring them back. Archiving never deletes data — it only changes what the list shows by default.
Incidents
The first screen an analyst should open: escalations grouped into incidents, ranked by risk, each with its summary, member alerts, timeline, and status. Pending IR approvals surface here and in the bell.
Click any incident to see the underlying alerts, copy affected users and IoCs to the clipboard, change its status, hand it off as a case, or generate a report. Narrow the list with the filter bar: full-text search plus status, severity, category, MITRE tactic/technique, source/agent IP, rule group, and compliance (the last four match the incident's correlated alerts). Click any column header to sort. Filters are reflected in the URL, so a filtered view is shareable.
How to read an incident's evidence, verify it, and reach a verdict: Reading an incident.
Environments
Per-environment health: connector session state, per-target probes (indexer and Wazuh API), ingest cadence and lag, and processing volume. When something stalls, this page says which half is unhealthy — your side (connector, indexer) or the processing side.
Two usage counters ride along per environment:
- Data (30d) — total data flowing in and out over the last 30 days. Open an environment to see it broken down into four windows (24h / 7d / 30d / all-time, with data in vs out and the number of queries). Every query Mobius makes against your Wazuh stack is counted, so nothing slips by.
- LLM (30d) — total AI tokens spent triaging and investigating that environment's alerts, with the same four windows (input vs output tokens and call count). Analysis that spans several environments is recorded too, but grouped separately since it can't be attributed to one environment.
Ingest can be paused per environment — useful during maintenance windows or noisy incident storms. Pausing stops new triage (and its cost) without touching the connector.