Your First Alert¶

Congratulations on connecting your SIEM! This guide explains what happens when your first alert arrives and how to interpret the AI triage results.

What Happens When an Alert Arrives¶

When Parapet Security receives an alert from your SIEM, it goes through a multi-stage AI pipeline:

graph TD
    A[Raw Alert Received] --> B[Secret Scrubbing]
    B --> C[AI Normalization]
    C --> D[Triage & Scoring]
    D --> E[Store in Dashboard]
    D --> F{Above Threshold?}
    F -->|Yes| G[Send Notification]
    F -->|No| H[Dashboard Only]

Stage 1: Secret Scrubbing¶

Before any AI processing, Parapet Security automatically removes sensitive data:

• API keys and tokens
• Passwords and credentials
• Credit card numbers
• Social Security Numbers
• Private keys

This ensures your sensitive data never reaches our AI models.

Stage 2: AI Normalization¶

Our AI converts any alert format to a standard schema:

{
  "rule": {
    "level": 12,
    "description": "Possible SSH brute force attack",
    "id": "5712"
  },
  "agent": {
    "name": "web-server-01",
    "ip": "192.168.1.100"
  },
  "data": {
    "srcip": "45.227.253.98"
  }
}

{
  "severity": "high",
  "category": "authentication",
  "title": "SSH Brute Force Attack Detected",
  "affected_entities": {
    "hosts": ["web-server-01"],
    "source_ips": ["45.227.253.98"]
  },
  "mitre_tactics": ["TA0006"],
  "mitre_techniques": ["T1110.001"]
}

Stage 3: Triage & Scoring¶

The AI analyzes the normalized alert and provides:

• Severity Assessment - Critical, High, Medium, or Low
• Confidence Score - How certain the AI is (0-100%)
• Recommendations - Suggested response actions
• MITRE ATT&CK Mapping - Tactics and techniques
• False Positive Likelihood - Based on context and patterns

Viewing Your Alert¶

In the Dashboard¶

1. Navigate to Alerts in the left sidebar
2. Your most recent alert appears at the top
3. Click on it to view full details

Alert List View¶

The alert list shows key information at a glance:

Alert Detail View¶

Click any alert to see the full analysis:

AI Triage Panel¶

┌─────────────────────────────────────────────────┐
│  Severity: HIGH          Confidence: 87%        │
├─────────────────────────────────────────────────┤
│  Category: Authentication                       │
│  False Positive Likelihood: Low (15%)           │
├─────────────────────────────────────────────────┤
│  MITRE ATT&CK:                                  │
│  • Tactic: Credential Access (TA0006)           │
│  • Technique: Brute Force - SSH (T1110.001)     │
└─────────────────────────────────────────────────┘

Recommendations¶

The AI provides actionable next steps:

Affected Entities¶

See which assets are impacted:

• Hosts: Servers, workstations, or devices
• Users: User accounts mentioned in the alert
• IPs: Source and destination IP addresses
• Files: File paths or hashes (for malware alerts)

Raw Payload¶

View the original alert from your SIEM (with secrets redacted).

Understanding Severity Levels¶

Understanding Confidence Scores¶

The confidence score indicates how certain the AI is about its triage:

What's Next?¶

Now that you understand how alerts work:

1. Set up notifications - Configure Slack or Email alerts
2. Customize thresholds - Adjust which alerts trigger notifications
3. Explore the dashboard - Learn filtering and search

Common Questions¶

Why is my alert showing as "Low" when my SIEM said "Critical"?¶

Parapet Security re-evaluates severity using AI analysis. Sometimes alerts that appear critical are actually false positives or less severe than the original SIEM rule suggests.

How long until my alert appears?¶

Most alerts appear within 10-30 seconds. High volumes may take up to 60 seconds.

Can I see the original SIEM alert?¶

Yes! The "Raw Payload" section in alert details shows the original alert (with secrets redacted).

What if I disagree with the AI triage?¶

You can mark alerts as false positives or update their status. Over time, this feedback helps improve the AI's accuracy.