Alerts vs. Offenses — and how to work them

Alerts are single detections; Offenses are the incidents they add up to.

1. 1Alerts: every time a detection rule matches an event (say, an encoded-PowerShell launch or a cleared audit log), one alert is raised — deduplicated per rule, machine, and day so a repeating event doesn't flood you. Acknowledge or close alerts on the Alerts page.
2. 2Offenses: related open alerts about the same machine or account are grouped automatically into a single offense with a magnitude score (severity-weighted). Ten detections on one workstation = one offense to triage, not ten notifications. High and critical offenses email your admins.
3. 3Work the Offenses page top-down by magnitude: open → Investigate (marks it in progress) → Close with a note describing what you found and did. Those notes appear in the Alert & Offense Review report — your audit evidence.
4. 4Use 'Ask Copilot' on any offense: it reads the offense, its alerts, and (if the machine also runs Security Posture Management) the device's security posture, then explains what likely happened and what to do next.
5. 5Tune the pack on the Detection Rules page — everything is on by default; toggle off anything that doesn't fit your environment (correlation rules stay on).