Skip to main content
Issues are the top-level work items in Clarion. Anything a monitor surfaces becomes an issue, and the agent watching that monitor triages it first. Benign and duplicate findings get dispositioned without you.

​
How issues get created

Two paths, depending on the monitor. Integrations that run their own detection (Okta, CrowdStrike, Microsoft Sentinel) hand Clarion a finished alert or case. Each one becomes an issue directly. Everything else sends raw events, called signals. Those become issues only when an alert filter (a signal rule) matches them. A filter can match a single event, or a sequence of events grouped by a shared field inside a time window. If signals are arriving but no issues appear, check the filters on that monitor. Clarion ships alert filter templates for every supported source. Fork one, or write your own.

​
What’s on an issue

  • Number: ISS-1, ISS-2, counting up per workspace.
  • Status: New, Triaging, Escalated, Resolved, or Closed.
  • Disposition: The triage verdict. One of Unknown, Benign, Suspicious, Confirmed Threat, False Positive, or Duplicated.
  • Severity: Critical, High, Medium, or Low.
  • Action required: Set when the issue is blocked on a human, either approval for a tool call or an answer to a clarification the agent asked for. This is what fills the Needs input queue.
  • Source: The integration the underlying signal came from.
  • Assignee: The member driving it.
  • Related issues: Findings linked under a shared parent. Campaign grouping and escalation chains both show up here.
  • Deduplication key: The external event ID. A redelivery carrying a key Clarion has already recorded folds into the existing issue instead of opening a second one.

​
What you can do

  • Triage it yourself, or hand it to an agent for the first pass.
  • Set disposition as you confirm or rule things out. Marking one Duplicated means naming the issue it duplicates.
  • Escalate to notify on-call and move the issue to Escalated. The button only appears while the status is New or Triaging.
  • Assign to a member, and reassign as ownership moves.
  • Resolve from the issue header, or pick any status from the badge dropdown.
  • Link tasks for follow-up work that outlives the issue.
Status, severity, assignee, and disposition can each be set across a selection of issues at once from the list view.
The Escalated and Needs input queues collapse child issues under their parent, so a grouped campaign reads as one row. Apply any filter, or search, and the list goes flat. The children reappear and the count jumps; nothing new happened, the filter just stopped collapsing them.
Learn about Tasks →