Platform · AI Alert Triage
Every finding,
pre-read.
Each insight arrives pre-read by Scout, enriched, mapped to ATT&CK and cited to its evidence. The verdict is still yours.
LSASS memory read by unsigned binary on WKS-2231
Raised 09:14 by watcher lsass-access-unsigned v3 · Acme Corp
Scout summary
An unsigned binary under m.reyes opened LSASS with read access two minutes after a WINWORD child process. Matches the pattern hunt H-118 confirmed on this host. Likely credential access; recommend hunt.
CVSS
8.8
EPSS
97th pct
CISA KEV
Listed
ATT&CK
T1003.001
Start at the verdict
Scout reads every insight first and writes the summary: what fired, which entities, and why it matters.
Enriched, not just scored
CVSS, EPSS, CISA KEV and exploit status sit on the finding. Severity comes from the source, never inflated.
Escalate in one move
One click opens a hunt with Scout. Select many findings and start one hunt from all of them.
02The queue
Needs review. Approved. Hunt started. Dismissed.
Findings from your rules, your vendors and your analysts land in one queue, normalised to OCSF, so every source looks the same in review.
- One queue. Know whether a finding came from a rule, a vendor or a colleague.
- Evidence travels. Observables, hunts, technique and raw event follow the finding into its hunt.
- Auto-hunt, on approval. A watcher or high-confidence intel can start the hunt, only where you allow it.
| Insight | Origin | Severity | State |
|---|---|---|---|
| LSASS read by unsigned binary · WKS-2231Detection Finding | Watcher | High | Hunt started |
| Indicator match · 185.220.x.x · proxyThreat Intelligence | Connection | High | Needs review |
| CVE-2026-2231 on SRV-DB-04Vulnerability Finding | Connection | Critical | Approved |
| Rare parent for rundll32 · LT-0917Detection Finding | Watcher | Medium | Needs review |
| Analyst note · suspected phishing waveDetection Finding | Manual | Low | Dismissed |
03In the loop
The queue is where the loop turns.
Watchers raise the finding. Threat intelligence enriches it. Scout reads it. A hunt resolves it, and what the hunt learned becomes the next watcher.
Open by design
OCSF
Every finding type mapped to OCSF classes.
MITRE ATT&CK
A technique on every insight, searchable across the queue.
EPSS · CISA KEV · NVD
Public exploitability signals attached, with links to the source.
Questions
Frequently asked questions
Does Scout close alerts by itself?
No. Scout reads each finding, enriches it and writes a summary. An analyst approves, dismisses or escalates it to a hunt.
What enrichment comes with a finding?
CVSS, EPSS, CISA KEV and exploit status where they apply, and the MITRE ATT&CK technique. Severity comes from the source and is never inflated.
Can I check Scout's summary?
Yes. Scout cites the evidence behind each claim, such as the rows, runs, entities or events it used, and flags anything it cannot support.
Where do findings come from?
Your watchers, your security vendors and your analysts. They land in one queue, normalised to OCSF, so every source reads the same in review.
Read the summary.
Make the call.
Meet automated attacks at their own speed, with your analysts in command.
- 01Sign up
- 02Run a guided hunt on the sample workspace, no connector needed
- 03Connect your own sources when you're ready
