Incidents

Violation triage and investigation workflow.

Violation triage and investigation workflow.

This screen belongs to the Secure deployment operator, not an ordinary hosted customer. Hosted customers have a separate account page with their own keys and limits; policy and service settings are not exposed there. Contact the operator to change protection. In the operator console, open the route listed above; a report tenant filter does not automatically scope a global setting.

Examples use educational data. Use your own authorized tenant in real integrations. Each screenshot shows the actual frontend, with the source and educational/demo mode stated below it.

Step-by-step actions

  1. Incidents → choose filters → open a record. Use Open incident on a separate page for full details.
  2. Check tenant, request_id, classes, verdict and reason. Start investigation changes status; Assign to me sets the assignee.
  3. Enter a note and Save note; add a label separately with Add.
  4. Set the appropriate final investigation state. False positive marks the incident and does not disable the detector.
  5. For correlation, Configure → edit thresholds → Apply. Cancel preserves previous values.

Every control and its meaning

Control / parameterValues, units and effect
Поиск, критичность, статус, типSearch ID/title/actor/request_id/tenant; filter critical/high/medium/low, investigation state and threat kind.
Назначено, метка, выбор записейMine/Unassigned narrow the queue. Checkboxes select records for bulk status updates; CSV exports the selection.
Коррелятор: injection_burst / dlp_burstIntegers ≥ 1, e.g. 3/15 tenant events per window. These thresholds create incidents rather than request decisions.
block_rate_min_reqs / block_rate_thresholdMinimum requests ≥ 1; block share UI 1–100%, API >0–1. Example: 10 requests and 50% = 0.5.
window_seconds / Tick / DedupWindow ≥ 10 seconds, example 600; Tick and Dedup are read-only. Zero does not disable correlation.
Карточка инцидента / DetailStatus, assignee, notes, labels, false positive, change history and audit links; save each action explicitly.

Verify the result

Reload the detail/history and verify status, assignee and notes. For thresholds, reread configuration and check the next pass using a synthetic tenant.

Errors, disabling and reverting changes

After a save error, reread the server before assuming a status change. Restore prior thresholds to revert; local runtime may require reconfiguration after restart. A green dot alone does not prove deduplication.

Actual correlation thresholds · actual staging
Actual correlation thresholds · actual staging
2026-10-15 · Actual staging application and an existing operator session. Synthetic data or non-personal configuration only; credentials and the operator profile are excluded. A form alone does not establish persistence or replica consistency.
  1. Injection threshold
  2. DLP threshold
  3. Block rate
  4. Window, seconds
  5. Apply
Actual correlation thresholds · actual staging
Actual correlation thresholds · actual staging
2026-10-15 · Actual staging application and an existing operator session. Synthetic data or non-personal configuration only; credentials and the operator profile are excluded. A form alone does not establish persistence or replica consistency.
  1. Injection threshold
  2. DLP threshold
  3. Block rate
  4. Window, seconds
  5. Apply
Synthetic incident detail · educational data
Synthetic incident detail · educational data
2026-10-15 · Actual application frontend on a local educational stand. All organizations, users and events are demo data; the image does not prove persistence or feature availability in your production.
  1. Start investigation
  2. Unassign
  3. Investigation notes and conclusions
  4. Save note
  5. new-label
  6. Add

Detailed security settings · Traffic analysis · FAQ · All application sections