SOC Workbench

Alert Triage QueueNew

A centralised triage queue that pulls high-priority alerts from every connected source — Event Manager, Defender, UBA, CVE Manager, MS365 Audit, AD Audit, Document Manager, and more — into a single analyst inbox for fast, consistent disposition.

Get a Demo Login to App

Alert Triage Queue

Unified analyst inbox for every security alert

What it does

Key capabilities

Multi-Source Aggregation

Pulls Critical and High alerts from Defender, UBA, Event Manager, CVE Manager, MS365 Audit, MS365 Assessment, AD Audit, and Document Manager into one queue.

Source & Severity Filters

Filter the queue by source, severity, or time window — filter chips auto-render for every active source with its own colour code.

One-Click Disposition

Acknowledge, escalate to investigation, suppress, or mark false positive — with optional analyst notes — without leaving the queue.

False Positive Integration

Dispositioned alerts feed directly into False Positive Management — suppression rules are created automatically from queue actions.

KPI Dashboard Strip

Real-time KPI tiles show total pending, Critical count, High count, and actioned alerts for the selected period.

Investigation Escalation

Escalate any alert directly into the Investigations module with one click — case is pre-populated with alert context.

Highlights

Why Alert Triage Queue?

  • Single triage inbox from 9+ alert sources
  • No alert is lost — every disposition is tracked in the audit table
  • Source chips auto-render — no config needed as new sources are added
  • False positive dispositions feed suppression rules automatically
  • Numbered pagination for large alert volumes
Request Demo Talk to us
Included in OneView

Alert Triage Queue is part of the Hakware OneView platform. All findings, events, and data from this module flow into your central dashboard alongside every other security signal in your environment.

24/7 Support Available
Phone: +27 060 984 1210
FAQs

Frequently asked questions

The Alert Triage Queue aggregates Critical and High severity alerts from: Microsoft Defender endpoint detections, User Behaviour Analytics anomalies, Event Manager correlation incidents, CVE Manager overdue critical findings, MS365 Audit anomalies, MS365 Assessment failed critical controls, On-Premises AD Audit high-risk findings, and Document Manager review overdue alerts.

Analysts can: Acknowledge (assign to self and begin investigation), Escalate to Investigation (create an Investigations case with the alert pre-attached), Suppress as False Positive (creates a False Positive Management rule to auto-suppress future matches), or Close with notes. Every disposition is timestamped, attributed to the analyst, and written to the audit table.

By aggregating all high-priority alerts from nine sources into a single inbox, analysts do not need to check multiple tools to find their highest-priority work. The queue sorts by severity and source, with a real-time KPI strip showing pending Critical and High counts. This single-inbox approach typically reduces MTTA significantly compared to checking each tool independently.

When an analyst marks an alert as a false positive from the triage queue, the disposition is forwarded directly to the False Positive Management module. A suppression rule is automatically created matching the alert's source, title, and severity pattern. Future alerts matching this rule are auto-suppressed without re-entering the queue, permanently reducing repetitive noise.

Related modules

False Positive ManagementNew

Suppress alert noise. Amplify real signal.

Learn more

Threat HuntingNew

Proactive threat hunting across your entire environment

Learn more

Asset Security ViewNew

Per-device security posture at a glance

Learn more

See Alert Triage Queue in action

Request a personalised demo and we'll show you exactly how Alert Triage Queue works within your environment.

Request Free Demo All Modules