Auto Triage is not enabled by default. To get access, contact Torq Support.
Overview
Guidance helps Auto Triage interpret alerts accurately and reduce noise. Describe how your environment works, how your SOC prefers to handle alerts, and which behavior is normal or risky. Auto Triage applies this information before it evaluates each alert, so its severity and verdict reflect your organization’s priorities.
You do not need to write guidance from scratch. Describe what you need in plain English, or attach a Runbook or procedure, and Socrates Builder drafts the guidance for you. See Create and edit guidance with Socrates Builder.
Guidance applies only to alerts ingested after the guidance entry is created or updated. Existing alerts are not re-evaluated.
When To Use
Use Guidance when:
Alert handling depends on context, not fixed rules.
You'd like to explain expected day-to-day behavior in your environment.
You want to reduce noise without forcing a final verdict.
Guidance provides context before alerts are triaged. Rules are applied after triage to enforce a final verdict. If you need to enforce a specific severity or verdict, use Rules instead.
How to use
Access the Guidance tab: To manage Guidance, click the Settings icon in the top-right corner of the Auto Triage page, then select the Guidance tab.
Add guidance:
Click Add guidance, then select Create manually.
Enter a Name and optional Description.
Select where the guidance applies:
Always: The rule applies to all ingested alerts.
By source: The rule applies only to selected alert sources.
Enter guidance text in the Guidance field.
Click Add to enable the guidance.
Each guidance entry is limited to 2,000 characters.
Additional actions
Check guidance status: To quickly confirm whether a guidance entry is active, check the Status toggle button on the right side of the guidance list to see if it is enabled or disabled.
Manage guidance options: Click the more options button to copy a direct link, duplicate, or delete the rule.
Review guidance impact on alerts
After configuring guidance, teams can verify its impact on alert handling during Auto Triage.
When reviewing an alert on the main Alerts page, scroll to the bottom of the alert details panel to view the Rules and Guidance section and see which guidance was applied.
To open a guidance configuration page directly from an alert, hover over the guidance entry in the Rules and Guidance section and click Go to Guidance.
Track guidance updates
In the guidance tab, you can see who created each entry and who last updated it, along with the corresponding timestamps. This provides quick visibility into ownership and recent changes directly from the guidance tab.
Guidance creation and deletion can also be validated in Torq’s audit log.
Create and edit guidance with Socrates Builder
Socrates Builder drafts guidance from your request, recent alerts, existing guidance and rules, and files you upload, such as playbooks or procedures. Use it to create new guidance or revise an existing entry. It splits long documents into focused entries that fit the 2,000-character limit.
Describe the context you want in plain English. For example, enter “our internal deployment tool runs scripts every night during the maintenance window,” and Socrates Builder drafts guidance. If you are unsure whether guidance or a rule fits, ask Socrates Builder to compare them.
Start a Socrates Builder session: Click Add guidance, then select Create with Socrates.
Describe the guidance: Enter your request in the prompt box. To start from a document, click the paperclip icon and attach a playbook or procedure.
Approve the guidance: Socrates Builder asks follow-up questions and shows a draft. When it is right, approve it, then choose whether to enable the entry or leave it disabled. The entry appears in the Guidance tab with the AI icon.
Revise an entry with Socrates Builder
To revise an entry, open it and click Edit with Socrates.
For more about working with Socrates Builder, see Socrates Builder: Build Workflows and AI Agents.
Examples
Providing Context for Approved Internal Software
Internally developed or business-critical applications may generate behavior that resembles malicious activity. By utilizing guidance to describe known execution patterns, network behavior, or maintenance windows associated with approved internal software, Auto Triage can better interpret intent and reduce noise, without compromising visibility or forcing a premature decision.
Expected Security Testing
Security teams often run breach-and-attack simulation tools that intentionally mimic real attacker behavior. By adding guidance that identifies known simulation vendors and their unique system fingerprints, Auto Triage can confidently classify this activity as authorized testing rather than a real threat. This reduces unnecessary escalations while ensuring true attacks remain visible and prioritized.
Steps
Use Auto Triage steps in your Torq workflows to manage guidance entries programmatically.
List guidance — Returns all guidance entries in the workspace, with optional filtering by enabled state.
Get guidance — Retrieves the full details of a specific guidance entry by ID.
Create guidance — Adds a new guidance entry. The entry becomes active immediately unless disabled.
Change guidance — Updates specific fields on an existing guidance entry without affecting unchanged fields.
Delete guidance — Permanently removes a guidance entry.
API
The Auto Triage public API provides programmatic access to triaged alerts and verdict management outside of workflows and the Auto Triage UI. It supports the same operations available through the workflow steps and through the Auto Triage interface.
FAQ
What permissions are required to use Guidance?
Rules and Guidance require the user to have the following Auto Triage scopes: Create and update triage context rules, View triage context rules, and Delete triage context rules. These scopes are not included in the default roles and must be assigned explicitly.
Does guidance enforce a severity or verdict?
No. Guidance provides context before triage to help interpret alerts, but it does not enforce a final severity or verdict. If you need to explicitly set or override an alert's outcome, you can just use rules instead.
When should I use guidance instead of rules?
Use guidance when alert handling depends on context or expected behavior, such as internal tools, maintenance windows, or security testing. Use rules only when you want to force a specific severity or verdict regardless of context.
How can I tell if guidance is being applied to an alert?
When viewing an alert, scroll to the bottom of the alert details pane and review the Rules and Guidance section. This shows which guidance entries were evaluated during auto triage and helps validate their impact.
How can I tell which entries Socrates Builder created?
In the Created and Last updated columns, a small purple AI icon appears on the avatar of the user who ran Socrates Builder. Hover over it to see "[user name] using AI." The icon also appears in the Rules and Guidance section of an alert.