Detections

Overview

Detections are security findings generated by the SIEM detection rules engine. When a rule matches suspicious activity in your ingested log sources, a detection is automatically created with a severity level, a description of what was found, and a link to the asset involved. You use the detections workflow to triage, investigate, assign, and resolve these findings.

Detections are a paid SIEM feature and require an active subscription.

Prerequisites

• A connected monitoring integration (for example AWS, GCP, GitHub, or 1Password) ingesting log data.
• At least one enabled detection rule for that data. See Detection Rules.
• The SIEM paid feature enabled for your organization.
• To change a detection’s status or assignee: the detections:edit ability, which the built-in Administrator role has. Team Member and Read Only can view detections. Commenting needs secops:edit, which Administrator and Team Member have.

How it works

The SIEM pipeline processes ingested security events against your detection rules on a schedule. When a rule fires, it creates a detection tied to an asset in your organization. Each detection records the rule that triggered it, a severity, a confidence, and the events and values that matched.

Detections follow a defined status workflow that guides your investigation from initial triage through resolution. Repeated matches for the same activity share a deduplication key, so you see one consolidated detection rather than repeated alerts for the same issue.

Usage / Configuration

Viewing detections

1. Go to Operations > Security Monitoring. The Detections tab opens.
2. The list shows your organization’s detections, most recent first, with the columns Severity, Event, Status, Confidence, Asset, Detected At, and Assignee.
3. Use Filter to narrow results by Severity, Status, Asset, Assignee, Event Type, Detection Rule, Tracked Externally, or Detected At.
4. Use the search box to find detections by title, description, asset name, or detection ID.
5. Click a detection to open Detection Details in a side panel. The panel’s Open full page button opens the detection on its own page.

Reading a detection

The detail panel shows:

• Actions — the status changes available from the current status.
• Event ID and Detection Rule. The rule name links to the rule’s details.
• Severity, Status, Confidence, Detected At, Assignee, and Tracking (the linked Linear or Jira issue).
• Description and Asset.
• Actor, Details (the values the rule matched), and Events, the events behind the detection. Investigate events opens Threat Hunting in a new tab, filtered to those events.
• Recommended Actions, from the rule.
• Comments, the discussion on the detection.

Understanding detection severity

Each detection takes its severity from the triggering rule. A rule can set a different severity for matches that meet a condition, such as many source IPs:

Severity	Meaning
Critical	Immediate action required — potential active compromise
High	Significant risk — investigate promptly
Medium	Moderate risk — schedule investigation
Low	Minor risk — review when convenient
Info	Informational — no action required

Confidence is a score from 0 to 100, shown as a label: Very Unlikely (1–19), Unlikely (20–39), Even Chance (40–59), Likely (60–79), Very Likely (80–99), or Certain (100). A confidence of 0 shows as Not Specified.

Triaging detections with status transitions

Detections follow a state machine with four statuses:

• New — freshly created, awaiting triage.
• Under Investigation — actively being investigated by a team member.
• False Positive — resolved as not a real threat.
• True Positive — resolved as a confirmed security event.

The allowed transitions, and the button that makes each one, are:

From	Buttons
New	Investigate, Mark as False Positive
Under Investigation	Mark as False Positive, Mark as True Positive
False Positive	Mark as True Positive, Re-investigate
True Positive	Mark as False Positive, Re-investigate

Investigate and Re-investigate move the detection to Under Investigation.

To change a detection’s status:

1. Open the detection from the list.
2. Under Actions, click the button for the new status. The same actions are in the row’s actions menu in the list.
3. The status updates immediately.

Assigning detections

1. On the detection detail panel, click the Assignee value. You can also click a detection’s assignee in the list.
2. Select a team member from the picker (only members of your organization are shown).
3. The assignee is notified, by default in their in-app inbox, by email, and by Slack DM when Slack is connected. Assigning a detection to yourself sends no notification.
4. To unassign, open the picker and choose No assignee.

Commenting on a detection

Use the Comments section of the detail panel to record findings for your team. You can edit or delete your own comments. When Slack is connected, replies in the Slack thread of a detection notification are added as comments too, if the Slack user maps to a Fencer member who can comment.

Bulk operations

You can perform actions on multiple detections at once:

1. Select detections using the checkboxes in the list. To select every detection that matches your filters across all pages, open the selection menu and choose All.
2. Choose a bulk action:
   • Transition — move the selected detections to Investigate, False Positive, or True Positive. Detections whose current status does not allow that change are skipped.
   • Assign — assign the selected detections to a team member.
   • Linear — create or link a Linear issue (requires the Linear integration).
   • Jira — create or link a Jira issue (requires the Jira integration).

Linking detections to external issue trackers

Detections can be linked to external issue trackers for workflow management:

• Linear — when the Linear integration is connected, click Linear under Tracking to create an issue, link the detection to an existing one, or unlink it.
• Jira — when the Jira integration is connected, click Jira under Tracking to do the same in Jira.

Without either integration, Tracking shows Setup integration, which opens your integration settings. Once linked, the detection shows the issue key, and you can filter the list with Tracked Externally.

Examples

Investigating a suspicious AWS CloudTrail detection

1. You receive a Medium detection from the AWS Root Credentials rule with status New.
2. Click the detection to open the detail panel and review the description, the affected asset, and the Details and Events sections.
3. Click the Assignee value and select yourself.
4. Click Investigate to move it to Under Investigation.
5. After reviewing the root account activity in Threat Hunting with Investigate events and confirming it was authorized maintenance, click Mark as False Positive.

Bulk-resolving false positives

1. Filter the detections list by Status is New and Severity is Info.
2. Select every matching detection with All in the selection menu.
3. Choose the Transition bulk action and pick False Positive.
4. All selected detections are updated.

Troubleshooting

• No detections appearing — Verify that your monitoring integrations are connected and ingesting data, and that the relevant rules show Enabled on the Rules tab. A rule whose data source is not connected is disabled, and its detail panel says why.
• Cannot transition to a specific status — Status transitions are restricted. For example, you cannot go directly from New to True Positive; you must first click Investigate. See the transitions table above.
• No Actions buttons or assignee picker — Your role does not have detections:edit. Ask an Administrator to make the change or to give your role that ability.
• Assignee not appearing in the picker — The user must be a member of your organization. Verify their membership in Admin > Team.
• External issue link not available — Ensure the corresponding integration (Linear or Jira) is connected and active for your organization.

Related pages

• Security Monitoring (SIEM)
• Detection Rules
• Threat Hunting
• SIEM Alerting
• Integrations Overview