Skip to main content
Alert Fields are the key-value pairs extracted from the underlying Security Events that make up an alert. Every field value is interactive — right-clicking or clicking on a field opens the Field Context Menu, giving analysts quick access to investigation tools, external lookups, indicator list management, and custom actions.

​
Quick Actions

The field context menu provides three quick actions at the top:
  • Copy Field — Copy the field name to the clipboard.
  • Copy Value — Copy the field value to the clipboard.
  • Use in Search — Start a new search pre-populated with the field and value.

​
Investigation

From any field, you can launch investigative workflows:
  • Recent Alerts with this Field — Find other alerts that share the same field value, helping identify patterns or repeat activity.
  • Explore Field — Open the field value in the Explore view for deeper analysis.
  • Follow-On Searches — Run a basic, advanced, or temporal search using the field value as a starting point.

​
External Lookups

Fields that contain recognisable indicators (IP addresses, domains, file hashes, etc.) can be sent to external intelligence platforms directly from the context menu. The available platforms are detected automatically based on the indicator type.

​
Indicator Lists

You can add or remove field values from Indicator Lists directly from the context menu. Lists are categorised by type:
List TypeDescription
BlocklistKnown malicious indicators to block.
AllowlistVerified safe indicators to suppress alerts.
WatchlistIndicators under active monitoring.
IOCIndicators of compromise from threat intelligence.
If the value already exists in a list, a checkmark is shown and selecting the list again will remove it. The top three lists are shown directly in the menu, with additional lists available under More Lists.

​
Custom Actions

If your organisation has configured Custom Actions, they appear in the field context menu under Execute Action. Custom actions receive the field name and value as input, allowing you to build automated response workflows that operate on specific indicators.

​
Field Actions

Field-level actions allow analysts to create rules based on specific field values:
  • Create Temporary Aggregation Rule — Create a short-lived aggregation rule that groups future alerts matching this field value. Useful for suppressing noise during an active investigation.
  • Create Aggregation Rule — Create a permanent aggregation rule based on the field.
  • Create Correlation Rule — Create a correlation rule that links alerts sharing this field value.
See Aggregations & Correlations for more on how these rules work.