Product Tour
Triage Agent — AI Verdict in Seconds
Step 2 of 8
AWS Root Account Login
root • us-east-1 • 14:32 UTC
Entity
root (AWS Account 123456789012)
Triage verdict
True Positive
Confidence
99%
The root account authenticated to the AWS console from IP 203.0.113.5, which resolves to a residential ISP in Kyiv, Ukraine. Root has not logged in from this IP or country in the previous 90 days. MFA was not used. No matching change management ticket was found in ServiceNow for today. The root account has a blast radius of 100 — all AWS resources in all regions are accessible.
Evidence
No prior logins from Kyiv, UA in last 90 days
MFA was not used for this login
No change management ticket matches this activity
IP reputation: -85 (anonymous proxy / VPN detected)
Verdict in under 5 seconds
The Triage Agent evaluates entity context, threat intel, change management data, and behavioral history to return a verdict with confidence score before a human analyst has opened the alert.
Structured evidence chain
Every verdict cites the specific data points that support it — IP reputation, login history, change ticket check — so analysts can verify the reasoning rather than accept it blindly.
Inline analyst override
If the verdict is wrong, analysts can override it inline with a reason. The override becomes training signal to improve future triage accuracy on similar patterns.