Alert triage
Every alert Mobius ingests goes through L1 triage, the automated equivalent of a level-1 analyst reading the alert, checking the playbooks, and writing up a verdict.
The ingest cycle
Mobius polls each active environment about once a minute. Each cycle:
- Queries the indexer for recent alerts through the connector.
- Deduplicates against everything already classified in the recent window, so the same alert is never triaged twice and never billed twice.
- Filters noise and fans the remainder out to the L1 analyst.
A temporarily unreachable environment will not fail triage. If a connected environment is down when the cycle runs, whether the host is down, the network blipped or the credentials are wrong, the run still completes and notes it in the run summary. That is an expected, logged condition, not an error. One offline environment never blocks triage for your others, and a run only shows as failed on a genuine problem.
What L1 produces
For each alert, the LLM-based analyst emits a structured decision:
| Field | What it is |
|---|---|
| Verdict | escalate / suppress, with the reasoning that led there |
| Risk score | a calibrated severity for prioritization |
| MITRE ATT&CK | technique and tactic enrichment |
| Rationale | a written explanation an analyst can audit |
The analysis is grounded in a corpus of security playbooks, so verdicts reflect documented practice rather than the model's own priors. Two tenant-owned inputs shape it further:
- Your knowledge base, free-form context about your estate, read before the alert is classified.
- Your known behavior rules. A hard rule auto-closes a matching alert before the model runs, at no cost. A soft rule hands your reason to the analysis and lets the model decide.
Every decision is logged as a first-class record. The console shows the full decision trail per alert, and the same data feeds the incident layer.
Escalations
An alert whose verdict is escalate does not go straight to a human: it enters incident correlation, where related escalations are grouped and re-examined by a deeper L2 pass. You read stories, not streams.
Triage cost scales with alert volume, and the dedup window plus noise filters exist precisely to keep that bounded. See Billing & pricing.