Detection Sources
Hiro can ingest detections from:How Detections Work
When a detection is received:- Ingestion — Detection is received via webhook or API poll
- Enrichment — Hiro queries related systems for context
- AI Summary — A concise, actionable summary is generated
- MITRE Mapping — Detection is mapped to ATT&CK techniques
- Deduplication — Related alerts are correlated
- Notification — You’re alerted based on severity
Viewing Detections
Navigate to Detections in the left sidebar to see your detection queue.Detection List
Detections are displayed with:- Severity — Critical, High, Medium, Low
- Title — Brief description of the threat
- Source — Where the detection originated
- Time — When the detection occurred
- Status — New, Investigating, Resolved
Filtering and Sorting
Filter detections by:- Severity level
- Source system
- Time range
- Status
- MITRE technique
Detection Details
Click any detection to see full details:AI Summary
Hiro generates a concise summary explaining:- What happened
- Why it matters
- Recommended next steps
MITRE ATT&CK Mapping
Detections are mapped to relevant MITRE ATT&CK techniques:Raw Detection Data
The original detection payload is preserved and accessible for detailed analysis.Investigating Detections
From any detection, you can:Start Chat Investigation
Click Investigate in Chat to open a conversation pre-loaded with detection context:Start Fight Mode
For active threats, click Investigate in Fight Mode to begin continuous hunting with the detection’s indicators already loaded.View Related Detections
Hiro correlates related detections automatically:Detection Status Workflow
Manage detection status as you work:Configuring Detection Sources
CrowdStrike
CrowdStrike detections are automatically ingested when you connect the integration. Configure which detection types to receive in Settings > Integrations > CrowdStrike.AWS GuardDuty
GuardDuty findings are pulled when you connect your AWS account. All finding types are ingested by default.Notification Settings
Configure how you’re notified about new detections:
Configure notifications in Settings > Notifications.
Best Practices
Triage by Severity
Focus on Critical and High severity detections first. Use filtering to manage your queue effectively.Correlate Before Acting
Check related detections before taking action—what looks like multiple incidents may be a single attack.Use AI Summaries
Hiro’s AI summaries provide quick context without reading raw logs. Trust but verify for critical decisions.Mark False Positives
Marking false positives helps improve detection quality over time and keeps your queue clean.Next Steps
Chat Interface
Investigate detections conversationally.
Fight Mode
Hunt threats continuously.
Remediation
Take action on detected threats.
Integrations
Connect more detection sources.