Alert Routing

Alert routing controls where new alerts go after Cotool creates them. Use it to automatically start response-agent triage for detection alerts and to understand which triggers are creating alert work.

​

Open routing

Go to Alerts > Triggers & Routing. The page shows:

• Alert volume from the last 30 days
• Alert sources
• Open unassigned detection alerts
• Response agents that can handle alerts
• A flow diagram from sources to response agents
• The default route for detection-created alerts

​

Detection alert routing

Detection-created alerts follow this order:

1. Use the detection’s override if one exists.
2. Otherwise use the organization default response agent.
3. If the effective setting is unassigned, create the alert and leave it open.

When a response agent is configured, Cotool creates the alert and immediately starts a triage run for that agent.

​

Set the organization default

1. Go to Alerts > Triggers & Routing.
2. Find Default alert-handling agent below the flow diagram.
3. Choose a response agent, or choose Leave unassigned to keep new detection alerts open.

Detections without their own override inherit this default.

​

Override one detection

From the detection itself:

1. Go to Detection > Detections and open the detection.
2. Open the Settings tab.
3. Under Routing, open Route alerts to and choose one of:
   • Default · agent name to inherit the organization default
   • Leave unassigned
   • A specific response agent

The change saves as soon as you pick an option. The detection needs a published version before its alerts can be routed. From Alerts > Triggers & Routing, you can also drag a detection onto a response agent in the flow diagram, or click a Cotool detection to open the same picker. Changing a route requires the Manage Alerts permission.

​

Trigger-created alerts

Response-agent triggers can create alerts when Create alert on trigger is enabled. Default behavior by trigger type: You can change the toggle when creating or editing the trigger. Trigger-created alerts are assigned to the response agent that owns the trigger, and Cotool starts that agent’s triage run from the alert. Cotool stores the original trigger payload with the alert. The alert detail page shows the payload in Alert Payload when it is available.

​

Routing outcomes

​

Keep routing healthy

Review Triggers & Routing when:

• New detection alerts are piling up as open and unassigned
• A response agent is deleted or disabled
• A detection should be handled by a different response agent than the organization default
• A trigger is producing too many or too few alerts