#Quickstart (SOC Operators)

#Where you spend most of your time

• Incident Management → Alerts: triage, investigate, and decide next actions.
• Incident Management → Cases: manage the lifecycle of incidents.

#Core workflows

#1) Triage an alert

• Open alert details
• Review assets/context
• Add tags (use your tagging taxonomy)
• Add comments and assign if needed

#2) Create and link a case

• Create a case from the alert when it needs tracking
• Link related alerts to the same case

#3) Attach evidence (artifacts)

• Upload case artifacts (files, exports)
• Use report templates when generating customer-ready PDFs

#4) Use SIEM search context

• When an alert references index_name + index_id, use the SIEM view to pivot into surrounding events

#If you can’t see alerts you expect

• Your org may have tag-based access control enabled (alerts require an allowed tag).
• See: Developer / AI Agent Docs → Database Schema → Tag access control and alert visibility for the underlying model.