This section walks through the building blocks of the platform: what each one does, how they relate, and how to put them to work.
Concepts at a glance
Your integrations feed Clarion two kinds of input. Some send a finished alert, which becomes an issue as-is. Others send raw events — signals — and those become issues only when an alert filter (signal rule) matches one. Issues are the top-level work items; related findings link under a shared parent so a campaign stays one investigation. Agents triage them using skills and tools (integrations that fetch context or take action). Tasks track follow-up work that outlives the issue. Notifications route approvals and clarifications to whoever needs to answer.Issues
The top-level work items: security events from connected integrations, deduplicated and prioritized for triage.
Tasks
Work items for follow-ups, agent improvements, and operational actions.
Agents
AI responders that investigate issues, execute response actions, and ask for approval when needed.
Skills
Reusable playbooks describing how to respond to specific situations.
Tools
Integrations agents invoke to take action, like Slack messages, DNS changes, and Jira tickets.
Notifications
In-app and external notifications, including approval and clarification requests from agents.
Settings
Configure your workspace, manage members, and enforce SSO.
How an issue becomes a response
A typical flow:- Issue opened: An event arrives from a connected integration, either as a finished alert or after an alert filter matches an incoming signal.
- Triage: An agent picks up the issue, follows the relevant skills, and calls tools to gather context. The agent produces a triage report with disposition and recommendations.
- Response: The agent executes through tools (revoking a token, posting to Slack, opening a Jira ticket) or escalates to your team via notifications. Sensitive actions pause for human approval.
- Closure: You resolve or close the issue once the threat is contained or ruled out. Anything left over becomes a task.