AI Triage reports

An AI Triage report is an AI-generated analysis of an EDR incident.

AI Triage is included with the Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) services, at no additional cost.

With an AI Triage report, you can:

  • Read a summary of the incident.
  • See how the attack maps to the MITRE ATT&CK framework.
  • Follow the timeline of the attack.
  • Review prioritized recommendations for containing and remediating the threat.
  • Check the confidence score for the analysis.

Enablement

AI Triage is disabled by default. You enable it once for each customer tenant. For more information, see Enabling AI Triage.

Report generation

For incidents with critical severity that were not mitigated automatically, the report is generated automatically. For all other incidents, you generate the report when you need it.

Monthly quota

The number of reports that you can generate is limited per month. When you reach the quota, the Monthly quota reached message is shown. The message states the date when the quota is reset.

Limitations

  • For incidents that involve more than one workload, the AI Triage report tab is not available.
  • The data that a report uses is retained for 14 days. After this period, the report is shown as expired.