Priority needs a visible basis
A useful priority explains why an alert deserves attention now. Nova can combine the detection’s supported severity with confidence, asset and cloud context, exposure, threat intelligence, related activity, and the quality of available evidence.
No single score replaces the alert evidence. A lower model signal should not erase independently supported high-severity evidence, and a high score should still be reviewed in context.
Triage an alert
- Confirm the detection, source, time, customer scope, and affected entities.
- Review severity, confidence, score explanation, and evidence coverage separately.
- Check related events, duplicates, recurrence, cloud exposure, important assets, and threat matches.
- Consider alert age, owner, current state, waiting reason, and any time-sensitive objective.
- Open an investigation when the evidence requires broader validation or the conclusion remains uncertain.
Record the result for future review
Record the disposition, supporting evidence, unresolved questions, owner, and next step. Explicit analyst outcomes can help teams assess detection quality. Missing feedback must not be silently treated as a false positive.