> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts & Triage

> Alert management, triage workflows, and inline actions for security investigation

The Alerts page is where security events become actionable. Alerts are generated when agent behavior triggers a policy violation, risk threshold, or threat signature.

## Alert Tabs

The page has three tabs:

<Tabs>
  <Tab title="Triage Queue">
    Unreviewed alerts that need human attention. This is the default view and where you'll spend most of your time. Alerts are sorted by severity (critical first), then by recency.

    Pending approval requests (e.g., an agent requesting elevated permissions) are merged into this queue so you have a single place for all items needing action.
  </Tab>

  <Tab title="All Alerts">
    Every alert in the selected time range, regardless of status. Use this for auditing and pattern analysis.
  </Tab>

  <Tab title="Resolved">
    Alerts that have been investigated, dismissed, or auto-resolved. Includes the resolution reason and who resolved them.
  </Tab>
</Tabs>

## Severity Levels

| Level        | Color  | Meaning                                                                        |
| ------------ | ------ | ------------------------------------------------------------------------------ |
| **Critical** | Red    | Immediate threat -- data exfiltration, unauthorized access, malicious tool use |
| **High**     | Orange | Significant risk -- policy violation, unusual behavior pattern                 |
| **Medium**   | Yellow | Notable deviation -- uncommon but not necessarily malicious                    |
| **Low**      | Blue   | Informational -- minor anomalies, first-time behaviors                         |

## Alert Card

Each alert in the queue shows:

* **Title** -- what happened (e.g., "Agent accessed sensitive file path")
* **Severity badge** -- color-coded severity level
* **Platform & agent** -- which AI agent triggered the alert
* **Device** -- which machine it happened on
* **Timestamp** -- when the event occurred
* **Context snippet** -- the relevant event data that triggered the alert

## Inline Actions

Every alert card has action buttons. No need to navigate away -- handle alerts right from the queue.

<CardGroup cols={2}>
  <Card title="Investigate" icon="magnifying-glass">
    Opens the full session detail view for the session that generated this alert. See the complete timeline and context.
  </Card>

  <Card title="Dismiss" icon="xmark">
    Dismiss the alert with a required reason: false positive, expected behavior, accepted risk, or duplicate.
  </Card>
</CardGroup>

## Triage Workflow

A typical triage flow:

<Steps>
  <Step title="Review the queue">
    Start with critical alerts. Read the title and context snippet to understand what happened.
  </Step>

  <Step title="Investigate if needed">
    Click "Investigate" to see the full session. Look at what the agent was doing before and after the triggering event.
  </Step>

  <Step title="Take action">
    Based on your investigation:

    * **Block** if the agent is actively doing something harmful
    * **Dismiss** if it's a false positive or accepted behavior
  </Step>

  <Step title="Move to next alert">
    Resolved alerts leave the triage queue. Work through until the queue is empty or at an acceptable level.
  </Step>
</Steps>

## Pending Approvals

When policies are configured with an approval workflow (rather than auto-block), the agent's request appears in the triage queue as a special alert type. These show:

* What the agent is requesting permission to do
* The policy that caught it
* A countdown timer (if a timeout is configured)
* **Approve** and **Deny** buttons

<Warning>
  If a pending approval expires without action, the default behavior depends on the policy: either the request is auto-denied (fail-closed) or auto-approved (fail-open). Check your policy configuration.
</Warning>

## Filtering

Filter alerts by:

* **Severity** -- critical, high, medium, low
* **Platform** -- specific AI agent platform
* **Status** -- unreviewed, investigating, resolved, dismissed
* **Device or agent** -- narrow to a specific source
* **Time range** -- respects the global time picker

<Tip>
  Bookmark filtered views for quick access. For example, bookmark "Critical + High from last 24h" for your morning triage routine.
</Tip>