Alert triage
Every alert Mobius ingests goes through L1 triage — the automated equivalent of a level-1 analyst reading the alert, checking the playbooks, and writing up a verdict.
The ingest cycle
Mobius polls each active environment about once a minute. Each cycle:
- Queries the indexer for recent alerts through the connector.
- Deduplicates against everything already classified in the recent window, so the same alert is never triaged (or billed) twice.
- Filters noise and fans the remainder out to the L1 analyst.
A temporarily unreachable environment will not fail triage: if a connected environment is down when the cycle runs (host down, network blip, wrong credentials), the run still completes and notes it in the run summary — an expected, logged condition, not an error. One offline environment never blocks triage for your others; a run only shows as failed on a genuine problem.
What L1 produces
For each alert, the LLM-based analyst emits a structured decision:
| Field | What it is |
|---|---|
| Verdict | escalate / suppress, with the reasoning that led there |
| Risk score | a calibrated severity for prioritization |
| MITRE ATT&CK | technique and tactic enrichment |
| Rationale | a written explanation an analyst can audit |
The analysis is grounded with retrieval-augmented generation over a corpus of security playbooks, so verdicts reflect documented practice, not just the model's priors. Two tenant-owned inputs shape it further:
- Your knowledge base — free-form context about your estate, retrieved into the prompt before classification.
- Your known behavior rules — a hard rule auto-closes a matching alert before the model runs (no tokens spent); a soft rule adds your reason to the prompt and lets the model decide.
Every decision is logged as a first-class record — the console shows the full decision trail per alert, and the same data feeds the incident layer.
Escalations
An alert whose verdict is escalate does not go straight to a human: it enters incident correlation, where related escalations are grouped and re-examined by a deeper L2 pass. You read stories, not streams.
Triage cost scales with alert volume, and the dedup window plus noise filters exist precisely to keep that bounded — see Billing & pricing.