Product · Alert triage and AI investigation
Every alert investigated. Nothing changed without you.
ThreatBreaker does the alert triage before your analyst opens the ticket: it gathers the evidence, builds the host timeline, finds the root cause and proposes a response. Your analyst reads the case and decides.
Thirty minutes. One alert, start to finish.
What alert triage is
Alert triage is sorting a pile of security alerts into what matters now, what can wait and what is noise. The word comes from the emergency room: the point is not to treat everyone at once, but to decide who is seen first.
An untriaged pile of alerts is the same as having no alerts. And triage is a decision, not a detection: it cannot find what detection missed.
Every alert ends up as one of three types:
- True positive
- A real attack. Act on it.
- False positive
- Looks like an attack, is not one. Close it, and tune the rule.
- Informational
- Real activity, but not worth acting on. Keep it for context.
An AI SOC analyst that shows its working
When a detection fires, ThreatBreaker writes the case before a person looks at it, and every conclusion points back to evidence your analyst can open.
- 01Collect the contextProcess, parent chain, command line, hash, signing status, network.
- 02Build the host timelineWhat happened on that machine, in order, before and after the alert.
- 03Find the root causeTrace the chain back to what started it: root cause analysis on the endpoint.
- 04Map to MITRE ATT&CKThe tactic and technique, so the case speaks your team's language.
- 05Propose a verdict and a responseA risk score, a false-positive likelihood and the next actions, ranked.
Why it asks before it acts
An automated tool that isolates machines on its own will, eventually, isolate the wrong one at the worst time, and you will hear about it from the customer. So ThreatBreaker takes the speed where the hours go, the investigation, and leaves the actions that can hurt you as a decision.
- ✓The investigation and evidence collection run on their own, around the clock.
- ✓Isolation, process kills and IP blocks are proposed and wait for approval by default.
- ✓You choose which playbooks may act without a person, and nothing else does.
- ✓Every automated action is written to a server-side record.
- Manual
- Notify-only
- Require approval (default)
- Auto, per playbook
That is the honest version of an autonomous SOC: agentic AI security that does the investigating on its own, while containment stays your call unless you hand it over.
How the four response modes work →Where the minutes go: mean time to respond
Mean time to respond is the clock from an alert appearing to something being done about it. Most of it is spent gathering: opening tools, pulling the process tree, checking the hash, writing the note. With alert triage automation, that work is done when your analyst arrives, so their minutes go on deciding.
We do not publish a percentage or a minute count. Ask us to run it on one of your own alerts instead.
Your model, your data, your switch
ThreatBreaker's own models by default
No third-party AI provider receives customer data unless you connect one.
Or bring your own key
OpenAI, Anthropic, Google Gemini, xAI or Jev by TypeSafe AI, with your own credentials.
Works without AI too
If AI is off, unavailable or air-gapped, deterministic rule-based analysis produces the same case structure.
In your team's language
Cases are written in English, Spanish or Ukrainian. Operators can switch AI off at any time.
What it gets wrong
It proposes, and a proposal can be wrong. That is why every sentence in the case cites the event it came from, the false-positive likelihood is shown on every case, and your analyst can reject a proposal as easily as approve it. The verdict is kept with the incident, so the next person sees what was decided and why. When a rule is noisy, you tune the rule.
Where investigation hands off
Once the case is clear, evidence collection takes over: forensic evidence packages stay with the incident for the auditor or the insurer, and a MITRE ATT&CK coverage view shows which techniques you have actually seen across the company.
Alert triage questions
- What is alert triage?
- Alert triage is sorting security alerts by what matters: deciding which are real, which can wait and which are noise, and what to do about the real ones.
- What is a triage in cyber security?
- It is the first decision on an alert: is this an attack, how serious is it, and who acts first. ThreatBreaker writes that case for your analyst, with the evidence attached.
- What are the three types of alerts?
- True positives (real attacks to act on), false positives (harmless activity that looked suspicious) and informational alerts (real activity not worth acting on).
- Does the AI act on its own, or does it ask first?
- It investigates on its own. Destructive actions such as isolation or killing a process are proposed and wait for approval by default; only playbooks you promote to Auto act without a person.
- What happens overnight, when nobody can approve?
- Investigation and evidence collection keep running, and the proposed response waits in the case. If a threat must be contained without waiting, promote that specific playbook to Auto.
- Which AI model does it use, and does customer data leave my environment?
- ThreatBreaker's own models by default, so no third-party provider receives your data. You can connect OpenAI, Anthropic, Google Gemini, xAI or Jev with your own key, or run fully on-premise.
- Is this security incident investigation software or a SOC analyst tool?
- Both, for endpoints: it investigates each security incident on Windows, Linux and macOS, and gives your SOC analysts a written case to approve or reject instead of a raw alert.
Watch it triage one of your alerts.
Thirty minutes, one alert, from raw detection to a proposed response, stopping at the approval prompt.