Start with onboarding
Evidence beside the verdict
Read the reason, entities and available references before acting on an escalation.
MSSP/MDR · Deliver the service
A verdict on every routed alert, in every tenant.
Evidence attached. Thresholds yours.
Virtus Triage gives every alert your rules route to it a verdict, with the confidence and evidence behind it, inside the customer's tenant. Your rule decides what happens next, and Virtus Cerebrum resolves eligible familiar alerts locally without another language-model call.
7-stage AI triage pipelineConfidence thresholds per ruleCerebrum learns per tenant
AlertsAll Tenants
Alerts
Impossible travel sign-inOkta / Northstar
HighSuspicious OAuth consent grant
Microsoft Sentinel / Harbor Retail
CriticalMicrosoft Sentinel / Harbor RetailNew inbox forwarding ruleMicrosoft Sentinel / Juniper
MediumMicrosoft Sentinel / JuniperVirtus Triage
- Rule
- Northstar identity alerts
- Auto-close threshold
- 0.85
- Escalate threshold
- 0.70
- On escalation
- Create Case + Trigger Pilot
Critical severity escalates by default. Filters and actions are settings on the rule.
ModusNorthstar
Virtus Triage
IngestEnrichPolicy GatesRAG + KAG ContextLLM DecisionValidateAudit & Execute
- Rule
- Northstar identity alerts
Policy gates and context contribute to a verdict. Configured actions determine the next step.
Impossible travel sign-in
OktaSource connector
NorthstarOwning tenant
Similar Past CasesAvailable customer history
Queue for Analyst ReviewConfigured Needs Human action
Virtus TriageNorthstar
Verdict & Confidence
0.82
EscalateConfidence, illustrative
- Escalate threshold
- 0.70
- Source
- Okta
- Alert
- Impossible travel sign-in
The rule selects Create Case + Trigger Pilot.
Evidence
Alert Context & EntitiesAccount: a.rivera / Northstar
EnrichmentSign-in context from Okta
Similar Past CasesEarlier customer identity investigations
Recommended & Analyst ActionsReview escalation and supporting references
CerebrumJuniper
Live Brain
Analyst outcomesHuman decisions contribute training labels
Virtus Triage verdictsRecorded decisions contribute training labels
Juniper modelValidated and activated by an operator
New inbox forwarding ruleEligible familiar alert
ResolvedModels & Training
- Juniper
- Own tenant history
- Northstar
- Separate tenant model
- Activation
- Operator decision
- Default mode
- Off
- Uncertain alerts
- Continue to Triage
Eligible local resolution avoids another LLM call. Uncertain alerts continue to Virtus Triage.
Rules choose the next action. Tenant context scopes supported views, API operations and connector credentials.
Alerts retain their customer context. A configured rule routes the selected Northstar alert to Virtus Triage.
Enrichment and policy gates precede the context and decision stages. The model does not choose the rule’s next action.
An illustrative escalation shows its confidence against the configured threshold, with supporting evidence.
Cerebrum learns from each tenant’s recorded outcomes. An eligible familiar Juniper alert resolves locally; uncertain alerts continue to Triage.
Illustrative customer workflow
01 - What it does
Make the decision reviewable.
A raw alert asks an analyst to gather context before deciding what it means. Virtus Triage brings a verdict and its evidence together, so the analyst can check the decision and handle the work that needs judgment.
Keep the threshold on the rule.
Virtus Triage returns Close, Escalate or Needs Human. Your rule chooses what happens next and can carry its own confidence thresholds, severity filter and sources. A model-proposed close must pass the applicable safety checks; uncertain results go to a person. Analysts can replace a verdict with a written reason, keeping the correction available for review and later context. An escalation can create a case and start Virtus Pilot when that action is configured.
Triage runs the same way for every customer, on each customer's own thresholds.
Northstar: identity ruleExample
- Auto-close threshold
- 0.85
- Escalate threshold
- 0.70
- Severity filter
- High and above
- Sources
- Okta, Microsoft Sentinel
Thresholds shown are product defaults; the customer rule and its sources are illustrative.
Rules reflect the customer
Choose filters, thresholds and the next action on the rule that routes the work.
02 - How it works in the product
Route, assess, then review.
Configure the path before sending customer alerts through it. Triage supplies the decision; your rule supplies the action, and Cerebrum adds local learning when its model and operating mode are configured.
- 01Modus
Route selected alerts to a Virtus Triage node with the customer’s filters and thresholds.
- 02Virtus Triage
Review the verdict, confidence and available evidence before accepting or overriding the decision.
- 03Cerebrum
Validate a tenant model and have an operator activate it before using its scores.
- 04Live Brain
Review local resolution and the alerts that continue to Virtus Triage.
AI capabilities run where licensed. Cerebrum defaults to Off; local closure requires configured automation and evidence checks.
03 - How it connects
Triage starts the service workflow.
A triage escalation can create a case and launch investigation when the rule includes that action. Cerebrum complements Triage by learning from recorded outcomes and resolving eligible familiar alerts locally.
Works with
In the editions
The PortalOutside the defaults
Discuss a license covering AI and provider operations.
Autonomous SOCIncluded
The AI capability belongs to this tier.
SecOps PlatformIncluded
Includes the Autonomous SOC capabilities.
04 - What it means for your service
Spend attention on the decisions that need it.
Analysts open a verdict with the work attached instead of a raw alert. Eligible repeat noise resolves locally, so familiar alerts do not cost another language-model call as you add customers.
Context gathered before review
The analyst opens a verdict with supporting work attached.
Control at the rule
Your thresholds and configured actions bound the next step.
Customer-specific learning
Each tenant’s model learns from its recorded analyst and Triage outcomes.
Start with one customer
- 01Choose a rule
Start with a supported source and a narrow alert selection.
- 02Review its outcomes
Check escalations and human-review results against the evidence.
- 03Evaluate local learning
Validate and activate a Cerebrum model before configuring local resolution.
Questions about Autonomous triage in every tenant.
1Can a provider also use Imperum’s AI triage?
AI agents belong to the Autonomous SOC and SecOps Platform product defaults; they are not part of The Portal’s default module set. If you want AI triage alongside provider operations, discuss a license that covers both capabilities, then configure the relevant integrations and triage rules. The enabled modules on your license determine access.
2What is Virtus Cerebrum?
Cerebrum learns from recorded analyst outcomes to build a tenant-specific false-positive scoring model. Depending on its operating mode, scores can be shown to analysts or contribute to case prioritization. It complements Triage and investigation workflows; separately configured automation can close eligible false positives.
3Does one customer’s history train another customer’s model?
Cerebrum trains a tenant-specific model on that tenant’s history inside the deployment. Sharing is a separate setting: Cloud Sync can send a model package with training samples to Imperum’s support service. Review sharing and export settings before deciding what may leave the environment.
Have any other questions? Talk to our team
Triage every customer the same way.
On their own thresholds.
Review a customer’s alert sources, triage rules and AI licensing with the Imperum team.