-
-
Notifications
You must be signed in to change notification settings - Fork 0
Event Triage
Available from
IRIS-NG-v1.3.0. Earlier releases have the two checkboxes described at the bottom of this page instead. See Changelog.
Every master-timeline event carries a verdict — the analyst's triage state. It is set from a single dropdown on the event modal, and it decides what the rest of the product does with that event.
| Verdict | Colour | Considered by AI + report | On the graph |
|---|---|---|---|
| To be determined | purple | yes | yes |
| True positive | green | yes | yes |
| False positive | red | no | no |
To be determined is the default. Every event starts there — added by hand, promoted off the working timeline, imported from CSV, or escalated from an alert. Nothing is excluded until you decide to exclude it.
One dropdown drives four things, and they cannot disagree with each other:
- Event colour on the timeline card
- Whether the AI considers the event — the executive case summary, the running timeline analysis panel, the case chat, and the surrounding context of the per-event analysis drawer
- Whether it reaches the generated report
- Whether it appears on the case graph
Marking one event as a false positive therefore removes it from all of them in a single action. Marking it back restores it.
The per-event analysis drawer still analyses a false positive if you open it. Only the surrounding context it reasons over is filtered. You opened the drawer on that card; refusing to look at it because it is excluded from aggregate summaries would answer a question you did not ask.
Exports are never filtered. /case/export and the encrypted .iris-case
portability export always contain every event, whatever its verdict. An export is a
complete record — see Case Export / Import. Only the generated
report is curated.
When you exclude events, the AI surfaces receive a count of how many you held back, and their prompts are explicit that a curated timeline must not be read as a quiet incident. A case with three visible events and twenty excluded ones does not get described as low-activity.
When nothing is excluded, the count is zero and the models are told to say nothing about curation at all.
Select events on the timeline (the double-check toolbar button), then use the gavel button to reveal three verdict actions — purple, green, red. This is the same operation as the dropdown, applied to every selected event.
The older Toggle Summary, Toggle Graph and free colour-swatch buttons are gone. They set the underlying values independently, which could leave an event whose colour said one thing and whose filtering did another.
The migration runs automatically at startup. Nothing needs to be done by hand.
Every existing event is examined and assigned a verdict:
- An event with both Add to summary and Display in graph switched off becomes a false positive. That was the only way to express "keep this out of the summary and the graph" before, so the intent carries over.
- Everything else becomes To be determined, including events created before either setting existed.
Events that had a mixed state — one setting on and the other off — are normalised to match their verdict. That combination is no longer expressible, and leaving it would produce a card whose colour contradicted its own filtering.
Events gain an event_verdict field: to_be_determined, true_positive or
false_positive.
It is optional. Clients and n8n workflows written before this field existed keep
working unchanged — an event created without a verdict gets the default. An
unrecognised value is also coerced to the default rather than rejected, so a
misspelling degrades rather than failing the request. A value that is present but not one
of the three is rejected with a 400.
event_in_summary and event_in_graph still exist on the event object and still mean
what they meant. They are now derived from the verdict, so sending them alongside a
verdict has no effect — the verdict wins. See API Reference.
- Dual Timeline — promoting tool-ingested events onto the master timeline
- AI Features — the surfaces a verdict gates
- Knowledge Map — the case graph