> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting the most value

> The setup choices that most increase the time and money Clarion saves you.

<Note>
  ROI is not automatic. It scales with how much of your stack Clarion can see and how much of your team's judgment it can execute. This checklist covers the changes with the biggest payoff, in order.
</Note>

<Steps>
  <Step title="Connect every signal source">
    Correlation and deduplication only work across the tools Clarion can see. Each missing integration is a blind spot where duplicate alerts still reach your team and context is missing from investigations. Start with your noisiest sources: SIEM, EDR, and cloud audit logs typically produce the most volume.
  </Step>

  <Step title="Put agents on your noisiest queues">
    Auto-resolution is the largest line in the ROI calculation, and it only happens where an [agent](/learn/agents/introduction) is watching. Use the built-in templates to cover common workflows first, then point agents at whichever issue sources dominate your Analytics volume.
  </Step>

  <Step title="Codify your playbooks as skills">
    An agent with generic knowledge triages. An agent with your [skills](/learn/skills/introduction) triages the way your best analyst would: it knows which systems are critical, which alerts are known-benign, and who to escalate to. Every playbook you capture also survives team turnover.
  </Step>

  <Step title="Tune alert filters">
    [Alert filters](/learn/issues/introduction) decide which raw signals become issues at all. A few well-placed rules for known-noisy patterns cut your false positive rate directly, which is pure recovered time.
  </Step>

  <Step title="Add proactive monitors">
    [Monitors](/learn/agents/monitors) on DNS records, endpoints, and infrastructure catch problems before they become incidents. Prevented incidents are the cheapest incidents.
  </Step>

  <Step title="Route approvals where people already are">
    Agents pause on sensitive actions until a human approves. If [notifications](/learn/notifications/introduction) land in Slack or Teams where your team already works, approvals take seconds and investigations do not stall waiting on a human.
  </Step>
</Steps>

## How you know it is working

Watch the Analytics page month over month:

* **AI Auto Resolved** should rise as agents and skills cover more of your queue.
* **False Positive Rate** should fall as filters and correlation absorb noise.
* **Mean Time to Respond** should fall as more issues get an instant first response.

When a metric plateaus, revisit the step above that feeds it. Then put the numbers into the [Measuring your ROI](/roi/measuring-roi) formulas to see the result in hours and dollars.