This month's Nebulog covers Alert Triage, which shipped with the ACE Platform launch on October 20, plus a set of quality of life improvements across the product.
Alert Triage Nebulock now provides Alert Triage to filter out alert noise from your existing security tools. While AI-SOC tools investigate every alert from a standing start, rebuilding the same picture of the same host every time it fires. Nebulock’s TRACE Graph has already built that picture. The hours that used to go into rebuilding context are hours back for other security work, eliminating low-value work from an analyst queue. We launched it with CrowdStrike, Microsoft Defender, and Microsoft Entra ID, with more to come.
Every alert gets a verdict with a confidence score and reasoning. True positives link back to Nebulock Findings already created through proactive hunting, and analysts can review or disagree with any verdict in the portal.
Three modes control how far the agent goes:
Passive (default): verdicts appear in the Nebulock portal only.Recommendation: verdicts, supporting evidence, and analyst feedback post back to the alert source.Autonomous: the agent also auto-closes high-confidence False Positive and Benign Positive alerts at the source. True Positive and Needs Human Review never auto-close.Alerts are ingested from configured alert-type integrations. The agent runs in Passive mode by default, and an Organization Admin can change it in Settings > Alert Triage.
New on the ACE Platform The ACE Platform launched in October, and we've continued shipping features to bring more of your environment inside the TRACE Graph. Vespyr added up a new hunt type for watchlisted users, Helix added VirusTotal reputation data, and GCP telemetry came online. We've also added new views and filters to improve your workflows.
New views and filters Filter hunts to show only the ones you started, and filter detections and investigations by the user who started or last modified them. Quickly find your active work without scrolling through your entire team's activity. Use the filter controls in Hunts, Detections, and Investigations views.
Automatic Insider Risk Hunts Vespyr now runs a new hunt type for users you've added to the Watchlist, extending her automated hunting coverage. Get proactive monitoring of flagged users for suspicious activity like unusual access patterns, credential misuse, and data exfiltration indicators. Configure the insider risk hunts to run daily, weekly, or monthly. Add users to the Watchlist under the Actors menu, and configure hunt frequency in Settings > Vespyr Settings.
VirusTotal Helix Integration Enrich file hashes, domains, and IPs with VirusTotal reputation data during investigations and alert triage. Adds threat intelligence context to every finding. Configure it in Settings > Integrations > VirusTotal.
Google Cloud Platform Telemetry Integration Ingest GCP audit logs and security findings alongside your existing telemetry sources. Extends detection and hunting coverage to your cloud infrastructure. Set up in Settings > Integrations > Google Cloud Platform.
Seeing it in your own environment If you want to see Alert Triage running against your own alert sources, reach out to your account manager or request a demo to see how Nebulock works in your environment.
