Alert routing controls where new alerts go after Cotool creates them. Use it to automatically start response-agent triage for detection alerts and to understand which triggers are creating alert work.
Open routing
Go to Triage > Sources & Routing.
The page shows:
- Alert volume from the last 30 days
- Alert sources
- Open unassigned detection alerts
- Response agents that can handle alerts
- A flow diagram from sources to response agents
- The default route for detection-created alerts
Detection alert routing
Detection-created alerts follow this order:
- Use the detection’s override if one exists.
- Otherwise use the organization default response agent.
- If the effective setting is unassigned, create the alert and leave it open.
When a response agent is configured, Cotool creates the alert and immediately starts a triage run for that agent.
Set the organization default
- Go to Triage > Sources & Routing.
- Find Default detection route.
- Choose a response agent, or choose Unassigned to keep new detection alerts open.
Detections without their own override inherit this default.
Override one detection
- Open the detection agent.
- Go to its configuration page.
- Find Alert Routing.
- Choose one of:
- Inherit organization default
- Leave alerts unassigned
- A specific response agent
- Click Save Routing.
Use Leave alerts unassigned for detections that should create reviewable
alerts but should not automatically start agent triage.
Trigger-created alerts
Response-agent triggers can create alerts when Create alert on trigger is enabled.
Default behavior by trigger type:
| Trigger | Default |
|---|
| Email | Create alerts |
| Webhook | Create alerts |
| Jira | Create alerts |
| Jira Automation | Create alerts |
| Linear | Create alerts |
| Bugcrowd | Create alerts |
| Slack | Do not create alerts |
| Schedule | Do not create alerts |
Routing outcomes
| Source | If routing is configured | If routing is not configured |
|---|
| Cotool detection | Alert is created and response-agent triage starts. | Alert is created open and unassigned. |
| Response-agent trigger | Alert is created for the trigger’s response agent when the toggle is on. | No alert is created when the toggle is off. |
Keep routing healthy
Review Sources & Routing when:
- New detection alerts are piling up as open and unassigned
- A response agent is deleted or disabled
- A detection should be handled by a different response agent than the organization default
- A trigger is producing too many or too few alerts
