Triage Workflow
Triage is the work of deciding, quickly and in the right order, which of the things Sandfly found need a person and what that person should do. Sandfly 6.0 is built around this work: every alert gets a severity, every host gets a severity from its alerts, and the User Interface (UI) sorts the fleet so that the worst host is always at the top.
The workflow has three stages, each one level deeper than the last:
| Stage | Where | Question it answers |
|---|---|---|
| Triage Hosts | Host triage page | Which hosts need attention first? |
| Triage Host Detail | The Triage tab of a host | What is wrong on this host, and is it one incident or several? |
| Triage Artifact Detail | The Artifact detail page | What is this process, file, or user, and what do I do about it? |
You can start at any stage. A notification, a Dashboard panel, or a colleague's link can take you straight to a host or an artifact. The pages in this section describe each stage on its own, and the actions that end a case (whitelist, respond, scan, flag) are available at every stage.
Severity
Every alert carries a severity from SEV 0 to SEV 5. The severity of an alert is set by the sandfly that found it. A host's severity is the highest severity among its alerting artifacts, or the rating that AI triage gave the host when a verdict exists. Each level has one color throughout the UI, so a chip, a row, or a group header shows at a glance how serious something is.
| Level | Reads as | Typical meaning |
|---|---|---|
| SEV 0 | Context | Nothing is alerting. Pass results and context only. |
| SEV 1 | Info | Hygiene or informational findings. |
| SEV 2 | Low | Worth a review, but rarely urgent. |
| SEV 3 | Moderate | A minor finding that someone should look at. |
| SEV 4 | High | A major finding. |
| SEV 5 | Critical | Treat as a probable compromise until shown otherwise. |
Two other signals refine the severity:
- ML score - For an executable, the machine learning (ML) analysis of the binary gives a threat score from 0 to 99, shown as
MLS nn. It is independent of the sandfly that raised the alert. Within one severity level, artifacts with a higher ML score sort first. - AI triage verdict - When AI triage is configured, Sandfly can ask a Large Language Model (LLM) for a verdict on a host or an artifact. A verdict can reclassify the severity of a host and of its artifacts. See AI triage below.
AI Triage
When AI triage is configured, Sandfly can ask a Large Language Model (LLM) for a verdict on a host or an artifact. A verdict can reclassify severities, so it changes the order in which hosts and detections sort. For what AI triage judges, what each verdict means, and what a verdict changes, see AI Triage.
In this workflow, a verdict usually leads to these next steps:
| Verdict | Usual next step |
|---|---|
| Clean | None. |
| Likely false positive | Whitelist the artifacts. |
| Needs attention | Fix the weakness. |
| Suspicious | Triage the host. |
| Likely malicious | Triage the host now. Consider response actions. |
| Likely compromised | Isolate and respond. |
A verdict is a second opinion, not a conclusion. Read its confidence, and confirm what it says in the evidence before you act on it.
What You Need
- A role that can read hosts and detections. Every stage of the workflow is available to normal users. Viewing and whitelisting need no extra role.
- The Responder role for response actions: retrieving a binary or file, and suspending, resuming, or killing a process. See Response Actions.
- An administrator to configure AI triage, AI analysis, and the response action settings.
Workflow Summary
- Open Host triage. Work the High priority band from the top.
- For each host, read the Finding column and the Host triage summary card. Decide: open the host, whitelist, flag it for later, or scan it again.
- On the host's Triage tab, walk the detection groups from the worst down. Look for detections that belong to one incident.
- Open an artifact when you need its forensic data, its sandfly results, its ML analysis, or its spread across hosts.
- Act: whitelist a false positive, fix a weakness, run a response action, or isolate the host. Then scan the host again and confirm that the detections are gone, or that they are still seen.
Updated 4 days ago