Triage

Triage is working through your events: marking what you have looked at, writing down what you decided, and hiding what you do not need to see again. This page covers labels, notes and every action in the row menu.

Every event has a menu of actions. Right-click the row to open it, or press the ⋮ button at the end of the event's label. It works the same on the events list and on the events listed inside the Map. Press Escape or click elsewhere to close it.

The menu starts with Mark (your labels, New label..., Manage labels...) and Comment.... On es-python rows it then has a Rule group, which turns the event into a rule in any of the four rule modes. On es-chromium rows it has Filter (the event's impact tags) and Block (hide events like this one) instead. Items that cannot act on the event you clicked are left out, so the menu can be shorter on some rows.

Labels

Labels are your own coloured tags for events, such as "triaged", "false positive" or "ticket filed". They are shared across all your lists, so one set of labels covers every product.

To put a label on an event, open its row menu and click the label under Mark; a tick shows it is on. Click it again to take it off. An event can carry several labels, and they appear as coloured chips on the row. To see only events with a label, pick it in the Label filter on the toolbar (see Filtering).

New label

New label... in the row menu creates a label and puts it on that event in one step. Give it a name (up to 48 characters) and pick a colour: Amber, Cyan, Red, Green, Blue, Slate, Violet or Pink. Label names must be unique.

Manage labels

Manage labels... in the row menu lists your labels. Change a name or colour and it is saved as soon as you leave the field; the chips on every event update with it. Delete removes a label after you confirm, and takes it off every event that carried it. That cannot be undone.

Notes

A note is a short comment you keep on an event, for the next person to look at it (or for you, next month): why it was checked, what was decided, the ticket number. Each event has one note, and events with a note show a ✎ marker on the row.

Choose Comment... in the row menu to write or edit it (up to 4,096 characters). The box opens with the current note, so you are editing it rather than replacing it. Save an empty note to delete it.

Rule (es-python)

On es-python rows, the Rule group turns the event you are looking at into a rule for events like it, in one of the four rule modes: Show (UI), Hide (UI), Don't send (drop) or Raise (machine). Picking a mode opens a short dialog with two choices:

Match events with the same: the rule always matches this event's sink and taint source. Tick Taint chain, Stack trace, Detail line or Origin to also require that field to equal this event's. The boxes start ticked the way your Unique event setting for that machine is, so by default the rule matches exactly what the list counts as this one event.
Applies to: This machine makes the rule for the machine that sent the event, the same as adding it in that machine's Configure window. All machines adds it to Sources & rules on the es-python Filters page.

Either way you can edit or remove the rule where it was added. A rule that matches extra fields says so under its pattern.

Raise (machine) appears only when Raise rules are enabled for your account (see Report and Raise). It matches the sink only, because the machine decides before it can compare a chain or trace.
Don't send (drop) asks you to confirm first, because a dropped event is never stored. A Don't send rule with extra fields is applied when the event reaches EyalSec.
Adding an all-machines rule that already exists, with no extra fields, adds nothing.

es-python rows do not have the Filter and Block groups described below; use the Tag filter on the toolbar to filter by impact tag.

Filter by tag

The Filter group lists the event's impact tags, for example Filter: sqli. Clicking one sets the Tag filter on the toolbar to that class, so the list shows only events of the same kind. The group is absent on events with no tags.

Block

On es-chromium, the Block items turn the event you are looking at into a standing filter that hides events like it, without retyping its details. The filter applies to the es-chromium list, takes effect immediately, and appears on the es-chromium Filters page, where you can review, switch off or delete it.

Blocking hides events from your lists; it does not stop the machine reporting them. To stop an event being reported at all, set a rule with the Drop mode.

Block this sink

Block this sink hides every event with exactly this sink label, from any source. Use it for an operation you have reviewed and do not want to see again.

Block this source

Block this source hides every event whose data came from this source, whatever sink it reached.

Block this tag

Block this tag, for example Block this tag: sqli, hides every event of that vulnerability class. It appears once for each of the event's impact tags.

A triage routine

One way to work through a busy list:

Filter to Critical and High with the Severity filter.
Open each event and read What this means.
Label it (for example "fixed", "accepted" or "false positive") and add a note saying why.
For findings that are expected and harmless, hide them: Rule > Hide (UI) on es-python, Block on es-chromium.
Filter by label later to check what is still open, and save the view as a saved search.