Auto Triage is not enabled by default. To get access, contact Torq Support.
Overview
Auto Triage connects to a broad range of security tools. Native data connectors are available for EDR and identity tools, with built-in ingestion, transformation, and deduplication. Once a source is connected and streaming, Auto Triage autonomously evaluates incoming security alerts. It assigns a verdict, sets severity, and routes the alert based on your configuration.
Supported alert sources
The following sources are currently available:
Data connectors
EDR
CrowdStrike - Ingests alerts from CrowdStrike Falcon. Set up the CrowdStrike data connector
SentinelOne - Ingests alerts from SentinelOne Singularity. Set up the SentinelOne data connector
Microsoft Defender - Ingests alerts from Microsoft Defender for Endpoint. Set up the Microsoft Defender data connector
Identity
Microsoft Entra ID - Ingests identity security events, including risky sign-ins, risk detections, and audit logs. Set up the Microsoft Entra ID data connector
Okta - Ingests authentication events, security events, and Identity Threat Protection (ITP) events. Set up the Okta data connector
Any source
Additional security tools are available in the Add source list in the Auto Triage configuration. Select your source, then set its Routing destination to Auto Triage. If your source is not in the list, use the Torq webhook integration.
Under Routing destination, select Auto Triage. Alerts received by this integration are routed to Auto Triage for autonomous triage. To use this option, Auto Triage must be enabled in your workspace.
Note: Auto Triage support is continuously expanding to additional alert sources and use cases, including CSPM and more.
Filtering alerts before triage
Not all incoming alerts need to be evaluated by Auto Triage. Before triage, alerts are filtered based on source-specific configuration. Auto Triage also omits raw events and audit logs that are not security alerts, ensuring only security-relevant events are triaged.
For EDR sources, filtering is based on alert type and is configured per integration and workspace. For identity sources, filtering is based on event category and is configured during connector setup. For webhook sources, all forwarded events are routed to Auto Triage for evaluation. Configure the webhook integration to forward only the alerts you want processed.
How alerts enter Auto Triage
Alerts are streamed into Torq from a supported alert source using its corresponding integration. Each integration instance represents a distinct alert source within a workspace.
When streaming to Auto Triage is enabled for a source:
Alerts are delivered as discrete events
Each alert is associated with its originating integration
Streaming applies only to new alerts
Before evaluation, streamed alerts are normalized into an internal event structure, and relevant observables are extracted.
How Auto Triage evaluates alerts
Auto Triage evaluates each eligible alert independently and produces a final verdict and severity.
Evaluation incorporates:
Alert metadata and extracted observables
Guidance, which provides environment-specific context
Rules that enforce deterministic outcomes when required
Auto Triage operates autonomously within these explicit guardrails. It evaluates risk but does not take action or modify source data.
For additional details, see:
Guidance to understand how contextual information influences risk interpretation
Rules to learn how deterministic logic can enforce verdict or severity outcomes
Verdict and severity logic for a complete description of evaluation outcomes
Permissions and access control
Auto Triage alerts are governed by granular triage permissions. These permissions ensure clear separation of duties while maintaining alignment with Case Management access controls.
Permissions determine who can:
View triaged alerts
Users can list and view alerts and their triage outcomes, but cannot modify them.
Update verdicts or submit feedback
Only users with permission to update alert verdicts can confirm or reject Auto Triage decisions or provide feedback.
Create or view cases from alerts
Case visibility and creation inherit permissions from the Case Management module and depend on the user’s case access level.
Manage triage logic (Guidance and Rules)
Viewing, creating, editing, and deleting triage rules and context are permissioned separately.
View triage metrics
Access to dashboards and aggregate triage metrics is controlled independently.
Users without the required permissions can still observe triage outcomes, but cannot change how alerts are evaluated or handled.
For a full breakdown of triage-related permissions and scopes, see Torq Roles and Scopes: Manage Access and Permissions.
Outputs produced by Auto Triage
After the evaluation completes, Auto Triage produces the following outputs for each evaluated alert:
A final verdict
A final severity
A configuration-based post-verdict action, as defined for the alert source (such as opening a case, triggering a workflow, or taking no action)
(Optional) Source-system closure for false positives, if enabled in the alert source configuration
These outputs represent the conclusion of the Auto Triage evaluation process.
Based on the configured verdict-to-action mappings for the alert source, Auto Triage initiates downstream handling. For example, a malicious verdict may open a case, while other verdicts may trigger workflows or result in no action, depending on configuration and licensing.
Details on how verdicts map to downstream behavior are covered in the Configuration article.
After triage: visibility and downstream handling
After Auto Triage completes evaluation, alerts remain available for review and may trigger downstream actions based on configuration.
Review individual alerts, verdicts, and analysis on the Alerts page.
Monitor aggregate triage outcomes and trends in the Auto Triage Dashboard.
Trigger workflows or open cases based on verdict-to-action mappings defined in Configuration.
Governance and guardrails
Auto Triage operates within explicit configuration and granular triage permissions that control who can view alerts, update verdicts, manage triage logic, and create cases.
Alerts are evaluated only when an alert source is configured in Auto Triage for a given integration.
Changes to the configuration apply only to alerts evaluated after the change.
These guardrails provide configuration-based control while preserving analyst oversight.