One analyst workflow
Nova keeps the reason an alert triggered, its supporting events, affected entities, cloud context, threat intelligence, confidence, and work state connected. Analysts can move from queue to evidence and investigation without rebuilding the case in each tool.
A detection is a starting point for review. It is not a final incident conclusion, proof of compromise, or permission to act.
Follow the operating cycle
-
01
Observe
Receive supported activity with source, scope, and time intact.
-
02
Detect and prioritize
Review alerts and the reasons behind their priority.
-
03
Investigate
Follow events, entities, chronology, cloud context, and threat matches.
-
04
Decide
Record the assessment, confidence, unknowns, owner, and next step.
-
05
Respond and learn
Use approved response paths and feed verified outcomes into coverage and detection review.
Keep quality and pressure visible
- Alert volume, age, ownership, waiting state, and service targets show operating pressure.
- Coverage, confidence, rule activity, feedback, and noise show where detection review is needed.
- Source health and evidence freshness show when a quiet queue may reflect missing data.
- Reported outcomes show whether work reached a supported conclusion or remained partial.