SecOps
Alerts and weekly triage
SecOps notifications help admins notice overdue vulnerability work and high exploit-likelihood findings. A weekly triage note gives a starting point for the team's review.
What raises an alert?
The app has two finding-alert rules:
| Alert | What it concerns |
|---|---|
| SLA breach | A team with open findings past their remediation deadline |
| Likely exploitable | An open vulnerability finding with an available EPSS probability at or above 50% |
An alert is raised once while its condition remains active. After it clears, the condition can raise a new alert if it returns. Read Deadlines and EPSS to understand the underlying measures.
These rules do not automatically alert for every Access attention item. A listed MFA or credential concern is something to investigate in its chapter, rather than a promise of a notification or ticket.
What does Scout send?
Starting SecOps installs a Scout operator, visible under Workspace → Operators. Once a week, environment admins receive a short triage note in portal notifications.
The note summarises open findings against four weeks earlier, overdue work, an urgent fix and exploit-likelihood or missing-owner attention. It is composed from fixed rules and the app's figures, without an AI model.
This week describes the review cadence. It does not turn the daily source pulls into continuous monitoring. A stale source can leave a note based on the last available measurements.
Use the note as a starting point
Open the relevant finding or fix, confirm coverage and ownership, and decide the next action. A notification is not evidence that an attacker reached your system, and the absence of a notification is not evidence that every provider is secure.
Use Jira tickets for vulnerability fix work and Access reviews to record account-change investigations. See Operators for the broader operator interface.