Triage¶
Triage is DXDT's front door for operational events. Your monitoring tools send alerts to a webhook; DXDT normalizes each one, classifies it with an AI triage agent, and decides whether it is noise, needs more context, or warrants an immediate investigation — before anyone is paged.
How it works¶
Every event moves through the same pipeline:
- Ingest — a monitoring tool POSTs the raw alert to your triage
webhook (
/ingest?key=<api key>), authenticated with a triage API key. - Normalize — the source is auto-detected and the payload is mapped to a canonical event: source, severity hint, summary, and the affected resource. Payloads from unrecognized tools are parsed with an LLM fallback, so unknown sources still produce usable events.
- Deduplicate — an event carrying the same source incident ID as one received in the previous hour is dropped as a duplicate.
- Classify — the triage agent returns one of three decisions, each with a severity, category, confidence score, and reasoning:
| Decision | Meaning | What happens next |
|---|---|---|
BENIGN |
Safe to ignore (resolved, test, or duplicate noise) | Event is closed |
ENRICH |
Possibly actionable, but context is missing | DXDT gathers context from your connected integrations and re-classifies (up to 2 passes, then the event is closed) |
ACTION |
Requires attention | An agent investigation is dispatched and notifications are sent |
Severities are CRITICAL, HIGH, MEDIUM, LOW, INFO. Event status
progresses through triaging, enriching, investigating, notified,
and closed.
Recognized alert sources¶
Payloads from these tools are detected and parsed natively: AWS CloudWatch, Azure Monitor, Datadog, Google Cloud Monitoring, Google Cloud Error Reporting, New Relic, Opsgenie, PagerDuty, Prometheus, Splunk, and Zabbix. Any other JSON payload is accepted and parsed via the LLM fallback.
Using it¶
The Triage page has four tabs: Event Log, Rules, API Keys, and Channels.
- Event Log — filter events by status, decision, or source. Open an event to see every triage decision, enrichment pass, and investigation finding. From the detail pane you can Close an event, Re-investigate it (a deeper pass that includes the previous findings), or Create Incident manually.
- API Keys — create one key per sending tool. The full key
(
tk_…) is returned once at creation; afterwards only a masked form is shown. Deleting a key immediately stops ingestion for it. - Rules — see below.
- Channels — per-severity notification routing; see Triage notifications.
Triage rules¶
Rules let you pre-empt the AI for events you already understand. Rules are evaluated by priority (highest first); when a rule matches, its action is used as the decision and the AI classification is bypassed.
A rule has a name, a source, an action, a priority, an active flag, and a
JSON condition with the fields severity_contains, summary_contains,
and resource_contains. An empty condition matches every event from the
selected source.
Escalation to incidents¶
On the Team page, the Auto-Escalation setting creates an incident
automatically whenever an event is classified ACTION at or above your
Escalation Threshold (Critical only, or Critical and High). The
incident is created immediately (CRITICAL → SEV1, HIGH → SEV2), the
triage event is linked to it, and a notification with a link to the
war room is sent. Any event can also be escalated
manually with Create Incident.
Configuration¶
| Setting | Where | Limits |
|---|---|---|
| Triage API keys | Triage → API Keys | — |
| Triage rules | Triage → Rules | Starter: 5 · Growth: 50 · Enterprise: unlimited |
| Notification channels | Triage → Channels | See notifications |
| Auto-escalation + threshold | Team → Auto-Escalation | — |
| Monthly triage events | Plan tier | Starter: 500 · Growth: 10,000 · Enterprise: unlimited |
Troubleshooting¶
| Symptom | Cause |
|---|---|
Webhook returns 401 |
The API key is invalid or has been deleted |
Response quota_exceeded |
Monthly event limit reached; events are not processed until the next period or a plan upgrade |
Response duplicate |
Same source incident ID was ingested within the last hour |
Rule creation rejected (402) |
Triage rule limit for your tier reached |
| Event closed without notification | Classified BENIGN, possibly after the maximum enrichment passes — use Re-investigate if you disagree |