Alert JSON
Nothing triaged yet
Paste an EDR alert as JSON on the left, open or drop a JSON file onto the editor, or load a sample, then press Triage. The verdict appears here with the reasons behind it, every behavior rule that matched, the ATT&CK tactics involved, and what threat intel says about each indicator.
Try a sample
What the card shows, most important first
- Overall verdict
- Malicious, suspicious, unknown or clean: the worst verdict from behavior and intel. For an OCSF finding or a SentinelOne threat, what the EDR said is shown next to it, with the format that was detected.
- Why
- One sentence per finding and lookup, with the ones that decided the verdict first.
- Behavior findings
- Each rule that matched, its severity, its ATT&CK techniques, and the matched text highlighted.
- Decoded commands
- The script hidden in an -EncodedCommand argument or a character-shifted string, decoded but never run.
- ATT&CK tactics
- The stages of an attack this alert touches, in kill-chain order.
- Threat intel
- VirusTotal and AbuseIPDB results per indicator, and whether each came from the cache, a live call, or was skipped.
What an alert can contain
Only hostname is required. The others are optional:
user, sha256, file_path, command_line,
parent_process, remote_ip and domain.
Any other field is rejected.
An OCSF finding (with finding_info and evidences) and a
SentinelOne threat (with threatInfo) are accepted too and converted to these fields.
A list of up to 25 alerts, or a SentinelOne API response ({"data": [...]}),
is triaged one by one and shown as a list. Files can be up to 64 KB.