How Triage Works
How an event becomes a conclusion
Hal watches every client every few minutes. The point of triage is that almost nothing reaches you, and what does is a conclusion rather than a pile of raw alerts to sort through. Every event runs the same layered pipeline before Hal writes you up.
- Blacklist. Static rules drop known-safe, high-volume noise first — the majority of events — at no model cost.
- Sigma rules. Around 600 open, community-maintained detection rules catch known attack patterns, also at no model cost.
- Tier 1 — fast model. A fast, inexpensive model reads what’s left and makes one call: routine, or worth a closer look.
- Tier 2 — second opinion. Anything Tier 1 wants to escalate is re-checked by a stronger model. This gate kills false alarms before they cost anything more.
- Tier 3 — investigation. Only genuine escalations reach the agentic investigator, which searches the logs, correlates across a client’s sources and integrations, and writes the report.
Known-bad source addresses are flagged against threat-intelligence feeds at ingestion, so that signal is available at every stage.
An escalation has to pass two independent judgments before Hal commits to it. That’s why what lands in your inbox is worth your time.
For the stage-by-stage version, see the Detection Pipeline reference. For what an escalation looks like when it arrives, see Reading a Report.