Triage Watch

The Triage Watch reviews incoming alerts so your analysts see only the ones that need their attention.

Worker	What it does	Works with
Alert Triage	Classifies alerts and proposes closing the false positives.	The Attack Discovery Worker, which skips the false positives this Worker closes, and the Rule Tuning Worker, which counts them when it looks for rules to tune.
Attack Discovery	Groups related alerts into attacks and checks each one.	The Forensics Watch, which investigates the attacks this Worker confirms or can't rule out.

You review the Watch's proposed actions in the Investigate section of the Proposed actions page. To learn how to decide the alert closures that the Alert Triage Worker proposes, refer to Decide a proposed action. To learn how to take a confirmed attack through to containment, refer to Respond to an attack.

When to turn on the Triage Watch

Turn on the Triage Watch when your team spends more time sorting alerts than investigating them. Turn on both Workers together, because the Alert Triage Worker closes false positives and leaves the Attack Discovery Worker fewer, more meaningful alerts to analyze. To learn whether each Worker fits your environment and has the data it needs, refer to when to use Alert Triage and when to use Attack Discovery.