> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> An overview of how Clarion's core concepts fit together, from incoming events to issues to response.

<Note>
  This section walks through the building blocks of the platform: what each one does, how they relate, and how to put them to work.
</Note>

## Concepts at a glance

Your integrations feed Clarion two kinds of input. Some send a finished alert, which becomes an **issue** as-is. Others send raw events — **signals** — and those become issues only when an **alert filter** (signal rule) matches one. Issues are the top-level work items; related findings link under a shared parent so a campaign stays one investigation. **Agents** triage them using **skills** and **tools** (integrations that fetch context or take action). **Tasks** track follow-up work that outlives the issue. **Notifications** route approvals and clarifications to whoever needs to answer.

<CardGroup cols={2}>
  <Card title="Issues" icon="shield-exclamation" href="/learn/issues/introduction">
    The top-level work items: security events from connected integrations, deduplicated and prioritized for triage.
  </Card>

  <Card title="Tasks" icon="list-check" href="/learn/tasks/introduction">
    Work items for follow-ups, agent improvements, and operational actions.
  </Card>

  <Card title="Agents" icon="robot" href="/learn/agents/introduction">
    AI responders that investigate issues, execute response actions, and ask for approval when needed.
  </Card>

  <Card title="Skills" icon="book" href="/learn/skills/introduction">
    Reusable playbooks describing how to respond to specific situations.
  </Card>

  <Card title="Tools" icon="wrench" href="/learn/tools/introduction">
    Integrations agents invoke to take action, like Slack messages, DNS changes, and Jira tickets.
  </Card>

  <Card title="Notifications" icon="message" href="/learn/notifications/introduction">
    In-app and external notifications, including approval and clarification requests from agents.
  </Card>

  <Card title="Settings" icon="gear" href="/learn/settings/introduction">
    Configure your workspace, manage members, and enforce SSO.
  </Card>
</CardGroup>

## How an issue becomes a response

A typical flow:

1. **Issue opened**: An event arrives from a connected integration, either as a finished alert or after an alert filter matches an incoming signal.
2. **Triage**: An agent picks up the issue, follows the relevant skills, and calls tools to gather context. The agent produces a triage report with disposition and recommendations.
3. **Response**: The agent executes through tools (revoking a token, posting to Slack, opening a Jira ticket) or escalates to your team via notifications. Sensitive actions pause for human approval.
4. **Closure**: You resolve or close the issue once the threat is contained or ruled out. Anything left over becomes a task.

<Tip>
  You don't have to build any of this from scratch. Clarion ships with agent templates, alert filter libraries, and skill templates for the most common SOC workflows.
</Tip>